Red Hat Bugzilla – Bug 160338
Audit not installed during upgrade from FC3 when selinux disabled
Last modified: 2007-11-30 17:11:07 EST
From Bugzilla Helper: User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050524 Fedora/1.0.4-4 Firefox/1.0.4 Description of problem: Audit not installed on system during upgrade from functional FC4. Selinux disabled on FC3 system. Kernel messages, or at least service startup, error and shutdown messages, disapear from system logs. Version-Release number of selected component (if applicable): audit-0.8.2-1 How reproducible: Always Steps to Reproduce: 1.Upgrade FC3 to FC4 2. 3. Actual Results: Upgraded system works, but service startup, error and shutdown messages disapear from system logs. Expected Results: From Release Notes auditd should be installed and enabled on FC4 system. At least some system messages are apparently directed to the audit.log. Additional info: Use yum to install audit!
I didn't write the release notes, so it may be wrong. Audit does not need to be installed for the system to work. audit-libs does need to be installed for pam and dbus. Did that package get installed? auditd only records auditable events from trusted programs. It does not record service startup or shutdown. This is done by syslogd. Messages should be controlled by /etc/syslogd.conf.
You are right audit log does not get these error messages. audit-libs is installed. Syslog.conf is dated August 2004, I think it is from FC1 installation and has not been changed. Boot.log still gets startup messages but not service startup or shutdown messages. Release Notes do indicate audit should be installed, but otherwise the upgraded system did seem to work.