Bug 158011 - audit log has "type=(null) msg=(null)"
audit log has "type=(null) msg=(null)"
Product: Fedora
Classification: Fedora
Component: audit (Show other bugs)
x86_64 Linux
medium Severity medium
: ---
: ---
Assigned To: Steve Grubb
: 158130 (view as bug list)
Depends On:
  Show dependency treegraph
Reported: 2005-05-17 15:29 EDT by Thomas J. Baker
Modified: 2007-11-30 17:11 EST (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2005-05-18 14:57:34 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Thomas J. Baker 2005-05-17 15:29:28 EDT
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.7.8) Gecko/20050512 Fedora/1.0.4-2 Firefox/1.0.4

Description of problem:
Not sure what this should be filed against but...

Clean install of fc4t3 + rawhide updates as of 5/16/2005 on an 64 bit smp xeon system. I get messages in my /var/log/audit/audit.log like this:

type=(null) msg=(null)
type=(null) msg=(null)
type=(null) msg=(null)
type=(null) msg=(null)
type=(null) msg=(null)
type=(null) msg=(null)
type=(null) msg=(null)

I've tried relabling but that hasn't fixed it. I know I can trigger the above messages just by trying to start dovecot from the /etc/init.d/dovecot script. (Strangely, if I just run 'dovecot' as root, it starts.)

Version-Release number of selected component (if applicable):
kernel-smp-2.6.11-1.1305_FC4, selinux-policy-targeted-1.23.14-2

How reproducible:

Steps to Reproduce:
1. install dovecot
2. try to start it

Actual Results:  Null error messages in /var/log/audit/audit.log

Expected Results:  meaningful audit messages?

Additional info:
Comment 1 Thomas J. Baker 2005-05-17 15:56:59 EDT
May 17th updates don't fix it either. (I thought maybe the libsepol updates
might have helped.)
Comment 2 Steve Grubb 2005-05-18 07:55:44 EDT
This is a known issue. The kernel has message types that the audit system didn't
understand. audit 0.8.1 was put into the build system yesterday to fix this.
Please upgrade to it when its available. If you want to build the package
yourself, you can find it at people.redhat.com/sgrubb/audit. Hope this helps.
Comment 3 Thomas J. Baker 2005-05-18 14:56:34 EDT
It missed today's rawhide so I rebuilt it myself and it works. Thanks.
Comment 4 Steve Grubb 2005-05-18 17:24:18 EDT
*** Bug 158130 has been marked as a duplicate of this bug. ***

Note You need to log in before you can comment on or make changes to this bug.