Hide Forgot
Description of problem: "Error - year is 1900" occurred when do auvirt with --start today/yesterday/this-week/this-month/this-year Version-Release number of selected component (if applicable): audit-2.6.5-3.el7.x86_64 libvirt-2.0.0-5.el7.x86_64 How reproducible: 100% Steps to Reproduce: 1. Enable and start auditd.service # systemctl enable auditd # systemctl start auditd 2. Start a domain # virsh start testvm 3. Check the audit log with auvirt command, with option --start recent: # auvirt --all-events --vm testvm --start recent res testvm root Wed Aug 17 15:00 cgroup deny all res testvm root Wed Aug 17 15:00 cgroup allow path rw /s3-qe-team/yanqzhan/testvm.qcow2 res testvm root Wed Aug 17 15:00 cgroup allow major rw pty res testvm root Wed Aug 17 15:00 disk start /s3-qe-team/yanqzhan/testvm.qcow2 res testvm root Wed Aug 17 15:00 net start 52:54:00:0b:85:fd res testvm root Wed Aug 17 15:00 mem start 1048576 res testvm root Wed Aug 17 15:00 vcpu start 1 start testvm root Wed Aug 17 15:00 4. Check the audit log with the auvirt command, with option --start today/yesterday/this-week/this-month/this-year: # auvirt --all-events --vm testvm --start today Error - year is 1900 # auvirt --all-events --vm testvm --start yesterday Error - year is 1900 # auvirt --all-events --vm testvm --start this-week Error - year is 1900 # auvirt --all-events --vm testvm --start this-month Error - year is 1900 # auvirt --all-events --vm testvm --start this-year Error - year is 1900 Actual results: As Step 4 descripted, "Error - year is 1900" occurred. Expected results: "Error - year is 1900" should not occur, auvirt command should work well with options --start today/yesterday/this-week/this-month/this-year option. Additional info: 1.It works well on rhel7.2 with audit-2.4.1-5.el7.x86_64, libvirt-1.2.17-13.el7.x86_64.
This appears to be an error in the man page. Looks like it was a copy and paste from the person that submitted the utility. It does not support any text based keywords like 'today'. It only supports numeric dates like 01/02/2000 but adjusted for the locale. This should probably be deferred to 7.4.
Fixed in upstream commit 2af2c02. After further review, turns out the use of the keywords is supported because the original code links against ausearch-time.c which was a surprise to me. After checking the code against known working example in ausearch-options.c, it was obvious that it needed to pass "00:00:00" for the time setting if time was NULL.
audit-2.7.4-1.el7 was built to resolve this issue.
Successfully reproduced and verified on all supported architectures. OLD (audit-2.6.5-3.el7_3.1) =========================== :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ LOG ] :: recent :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ PASS ] :: Command 'cp -f sample.log.template sample.log' (Expected 0, got 0) :: [ PASS ] :: Command 'sed -i "s/<PASS>/1493374812/" sample.log' (Expected 0, got 0) :: [ PASS ] :: Command 'sed -i "s/<FAIL>/1493374212/" sample.log' (Expected 0, got 0) :: [ PASS ] :: Command 'auvirt -ts recent --proof --file sample.log' (Expected 0, got 0) :: [ PASS ] :: File '/var/tmp/rlRun_LOG.UtELrgDM' should contain 'pass' :: [ PASS ] :: File '/var/tmp/rlRun_LOG.UtELrgDM' should not contain 'fail' :: [ PASS ] :: Command 'rm -f sample.log' (Expected 0, got 0) :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ LOG ] :: today :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ PASS ] :: Command 'cp -f sample.log.template sample.log' (Expected 0, got 0) :: [ PASS ] :: Command 'sed -i "s/<PASS>/1493375114/" sample.log' (Expected 0, got 0) :: [ PASS ] :: Command 'sed -i "s/<FAIL>/1493202314/" sample.log' (Expected 0, got 0) Error - year is 1900 :: [ FAIL ] :: Command 'auvirt -ts today --proof --file sample.log' (Expected 0, got 1) :: [ FAIL ] :: File '/var/tmp/rlRun_LOG.Q8FQsofR' should contain 'pass' :: [ PASS ] :: File '/var/tmp/rlRun_LOG.Q8FQsofR' should not contain 'fail' :: [ PASS ] :: Command 'rm -f sample.log' (Expected 0, got 0) :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ LOG ] :: yesterday :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ PASS ] :: Command 'cp -f sample.log.template sample.log' (Expected 0, got 0) :: [ BEGIN ] :: Running 'sed -i "s/<PASS>/1493288716/" sample.log' :: [ PASS ] :: Command 'sed -i "s/<PASS>/1493288716/" sample.log' (Expected 0, got 0) :: [ PASS ] :: Command 'sed -i "s/<FAIL>/1493202316/" sample.log' (Expected 0, got 0) Error - year is 1900 :: [ FAIL ] :: Command 'auvirt -ts yesterday --proof --file sample.log' (Expected 0, got 1) :: [ FAIL ] :: File '/var/tmp/rlRun_LOG.TXBqXQtL' should contain 'pass' :: [ PASS ] :: File '/var/tmp/rlRun_LOG.TXBqXQtL' should not contain 'fail' :: [ PASS ] :: Command 'rm -f sample.log' (Expected 0, got 0) :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ LOG ] :: this-week :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ PASS ] :: Command 'cp -f sample.log.template sample.log' (Expected 0, got 0) :: [ PASS ] :: Command 'sed -i "s/<PASS>/1493375119/" sample.log' (Expected 0, got 0) :: [ PASS ] :: Command 'sed -i "s/<FAIL>/1492770319/" sample.log' (Expected 0, got 0) Error - year is 1900 :: [ FAIL ] :: Command 'auvirt -ts this-week --proof --file sample.log' (Expected 0, got 1) :: [ FAIL ] :: File '/var/tmp/rlRun_LOG.HhbuUZpG' should contain 'pass' :: [ PASS ] :: File '/var/tmp/rlRun_LOG.HhbuUZpG' should not contain 'fail' :: [ PASS ] :: Command 'rm -f sample.log' (Expected 0, got 0) :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ LOG ] :: this-month :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ PASS ] :: Command 'cp -f sample.log.template sample.log' (Expected 0, got 0) :: [ PASS ] :: Command 'sed -i "s/<PASS>/1493375121/" sample.log' (Expected 0, got 0) :: [ PASS ] :: Command 'sed -i "s/<FAIL>/1490696721/" sample.log' (Expected 0, got 0) Error - year is 1900 :: [ FAIL ] :: Command 'auvirt -ts this-month --proof --file sample.log' (Expected 0, got 1) :: [ FAIL ] :: File '/var/tmp/rlRun_LOG.WBrKBWRp' should contain 'pass' :: [ PASS ] :: File '/var/tmp/rlRun_LOG.WBrKBWRp' should not contain 'fail' :: [ PASS ] :: Command 'rm -f sample.log' (Expected 0, got 0) :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ LOG ] :: this-year :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ PASS ] :: Command 'cp -f sample.log.template sample.log' (Expected 0, got 0) :: [ PASS ] :: Command 'sed -i "s/<PASS>/1493375124/" sample.log' (Expected 0, got 0) :: [ PASS ] :: Command 'sed -i "s/<FAIL>/1461839124/" sample.log' (Expected 0, got 0) Error - year is 1900 :: [ FAIL ] :: Command 'auvirt -ts this-year --proof --file sample.log' (Expected 0, got 1) :: [ FAIL ] :: File '/var/tmp/rlRun_LOG.3hEBio3U' should contain 'pass' :: [ PASS ] :: File '/var/tmp/rlRun_LOG.3hEBio3U' should not contain 'fail' :: [ PASS ] :: Command 'rm -f sample.log' (Expected 0, got 0) NEW (audit-2.7.6-1.el7) ======================= :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ LOG ] :: recent :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ PASS ] :: Command 'cp -f sample.log.template sample.log' (Expected 0, got 0) :: [ PASS ] :: Command 'sed -i "s/<PASS>/1493374951/" sample.log' (Expected 0, got 0) :: [ PASS ] :: Command 'sed -i "s/<FAIL>/1493374351/" sample.log' (Expected 0, got 0) :: [ PASS ] :: Command 'auvirt -ts recent --proof --file sample.log' (Expected 0, got 0) :: [ PASS ] :: File '/var/tmp/rlRun_LOG.pPLC0sxQ' should contain 'pass' :: [ PASS ] :: File '/var/tmp/rlRun_LOG.pPLC0sxQ' should not contain 'fail' :: [ PASS ] :: Command 'rm -f sample.log' (Expected 0, got 0) :: [ LOG ] :: Duration: 1s :: [ LOG ] :: Assertions: 7 good, 0 bad :: [ PASS ] :: RESULT: recent :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ LOG ] :: today :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ PASS ] :: Command 'cp -f sample.log.template sample.log' (Expected 0, got 0) :: [ PASS ] :: Command 'sed -i "s/<PASS>/1493375253/" sample.log' (Expected 0, got 0) :: [ PASS ] :: Command 'sed -i "s/<FAIL>/1493202453/" sample.log' (Expected 0, got 0) :: [ PASS ] :: Command 'auvirt -ts today --proof --file sample.log' (Expected 0, got 0) :: [ PASS ] :: File '/var/tmp/rlRun_LOG.LHJM0O5C' should contain 'pass' :: [ PASS ] :: File '/var/tmp/rlRun_LOG.LHJM0O5C' should not contain 'fail' :: [ PASS ] :: Command 'rm -f sample.log' (Expected 0, got 0) :: [ LOG ] :: Duration: 1s :: [ LOG ] :: Assertions: 7 good, 0 bad :: [ PASS ] :: RESULT: today :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ LOG ] :: yesterday :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ PASS ] :: Command 'cp -f sample.log.template sample.log' (Expected 0, got 0) :: [ PASS ] :: Command 'sed -i "s/<PASS>/1493288856/" sample.log' (Expected 0, got 0) :: [ PASS ] :: Command 'sed -i "s/<FAIL>/1493202456/" sample.log' (Expected 0, got 0) :: [ PASS ] :: Command 'auvirt -ts yesterday --proof --file sample.log' (Expected 0, got 0) :: [ PASS ] :: File '/var/tmp/rlRun_LOG.P1thCypq' should contain 'pass' :: [ PASS ] :: File '/var/tmp/rlRun_LOG.P1thCypq' should not contain 'fail' :: [ PASS ] :: Command 'rm -f sample.log' (Expected 0, got 0) :: [ LOG ] :: Duration: 1s :: [ LOG ] :: Assertions: 7 good, 0 bad :: [ PASS ] :: RESULT: yesterday :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ LOG ] :: this-week :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ PASS ] :: Command 'cp -f sample.log.template sample.log' (Expected 0, got 0) :: [ PASS ] :: Command 'sed -i "s/<PASS>/1493375258/" sample.log' (Expected 0, got 0) :: [ PASS ] :: Command 'sed -i "s/<FAIL>/1492770458/" sample.log' (Expected 0, got 0) :: [ PASS ] :: Command 'auvirt -ts this-week --proof --file sample.log' (Expected 0, got 0) :: [ PASS ] :: File '/var/tmp/rlRun_LOG.5VthFVpM' should contain 'pass' :: [ PASS ] :: File '/var/tmp/rlRun_LOG.5VthFVpM' should not contain 'fail' :: [ PASS ] :: Command 'rm -f sample.log' (Expected 0, got 0) :: [ LOG ] :: Duration: 1s :: [ LOG ] :: Assertions: 7 good, 0 bad :: [ PASS ] :: RESULT: this-week :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ LOG ] :: this-month :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ PASS ] :: Command 'cp -f sample.log.template sample.log' (Expected 0, got 0) :: [ PASS ] :: Command 'sed -i "s/<PASS>/1493375261/" sample.log' (Expected 0, got 0) :: [ PASS ] :: Command 'sed -i "s/<FAIL>/1490696861/" sample.log' (Expected 0, got 0) :: [ PASS ] :: Command 'auvirt -ts this-month --proof --file sample.log' (Expected 0, got 0) :: [ PASS ] :: File '/var/tmp/rlRun_LOG.STphFy6w' should contain 'pass' :: [ PASS ] :: File '/var/tmp/rlRun_LOG.STphFy6w' should not contain 'fail' :: [ PASS ] :: Command 'rm -f sample.log' (Expected 0, got 0) :: [ LOG ] :: Duration: 1s :: [ LOG ] :: Assertions: 7 good, 0 bad :: [ PASS ] :: RESULT: this-month :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ LOG ] :: this-year :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ PASS ] :: Command 'cp -f sample.log.template sample.log' (Expected 0, got 0) :: [ PASS ] :: Command 'sed -i "s/<PASS>/1493375263/" sample.log' (Expected 0, got 0) :: [ PASS ] :: Command 'sed -i "s/<FAIL>/1461839263/" sample.log' (Expected 0, got 0) :: [ PASS ] :: Command 'auvirt -ts this-year --proof --file sample.log' (Expected 0, got 0) :: [ PASS ] :: File '/var/tmp/rlRun_LOG.RiTfEPKO' should contain 'pass' :: [ PASS ] :: File '/var/tmp/rlRun_LOG.RiTfEPKO' should not contain 'fail' :: [ PASS ] :: Command 'rm -f sample.log' (Expected 0, got 0) :: [ LOG ] :: Duration: 2s :: [ LOG ] :: Assertions: 7 good, 0 bad :: [ PASS ] :: RESULT: this-year For more details see TJ#1830812.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2017:2008