Hide Forgot
Description of problem: When I do the below three commands the auid shown back to me is not the same from all the commands, but it's the same event. In the first aureport I'm getting back an auid of zero for root. In the second aureport I get back my teammate's auid. Also in the ausearch for the specific event I get my teammate's auid. I would expect my teammate's auid across all but that's not what I see. It seems the first aureport replaces the auid with uid. I asked on the mailing list but it's moderated and I haven't gotten through yet. Version-Release number of selected component (if applicable): audit-2.3.7-5.el6.x86_64 How reproducible: 100% Steps to Reproduce: 1. aureport -l # and look at auid 2. aureport -l --summary # look at auid 3. ausearch --message USER_LOGIN # look at auid Actual results: Sometimes the auid matches what was in that log entry and sometimes it matches the uid of that log entry. Expected results: I would expect auid to always be reported as it was in the actual log entry. Additional info: N/a
This is fixed in audit-2.4.1. https://fedorahosted.org/audit/changeset/1047 Closing on the rebase bug since it fixes the issue. *** This bug has been marked as a duplicate of bug 1257650 ***