Skip to content

Commit

Permalink
audit: Make AUDIT_KERNEL event conform to the specification
Browse files Browse the repository at this point in the history
The AUDIT_KERNEL event is not following name=value format. This causes
some information to get lost. The event has been reformatted to follow
the convention. Additionally the audit_enabled value was added for
troubleshooting purposes. The following is an example of the new event:

  type=KERNEL audit(1480621249.833:1): state=initialized
              audit_enabled=0 res=1

Signed-off-by: Steve Grubb <sgrubb@redhat.com>
[PM: commit tweaks to make checkpatch.pl happy]
Signed-off-by: Paul Moore <paul@paul-moore.com>
  • Loading branch information
RH-steve-grubb authored and pcmoore committed Dec 14, 2016
1 parent 533c7b6 commit 7c397d0
Showing 1 changed file with 3 additions and 1 deletion.
4 changes: 3 additions & 1 deletion kernel/audit.c
Original file line number Diff line number Diff line change
Expand Up @@ -1344,7 +1344,9 @@ static int __init audit_init(void)
panic("audit: failed to start the kauditd thread (%d)\n", err);
}

audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL, "initialized");
audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL,
"state=initialized audit_enabled=%u res=1",
audit_enabled);

return 0;
}
Expand Down

0 comments on commit 7c397d0

Please sign in to comment.