Login or Register to Ask a Question and Join Our Community


UNIX for Dummies Questions & Answers

Audit Control

 
Thread Tools Search this Thread
Top Forums UNIX for Dummies Questions & Answers Audit Control
# 1  
Old 12-08-2009
Audit Control
Hi,

AUDITD is reporting the following in the logs:

Code:
type=AVC msg=audit(1260289801.448:70566): avc:  denied  { read write } for  pid=18495 comm="postdrop" path="socket:[12414105]" dev=sockfs ino=12414105 scontext=root:system_r:postfix_postdrop_t:s0-s0:c0.c1023 tcontext=system_u:system_r:rpm_t:s0 tclass=tcp_socket
type=AVC msg=audit(1260289801.448:70566): avc:  denied  { read write } for  pid=18495 comm="postdrop" path="socket:[12414111]" dev=sockfs ino=12414111 scontext=root:system_r:postfix_postdrop_t:s0-s0:c0.c1023 tcontext=system_u:system_r:rpm_t:s0 tclass=tcp_socket
type=AVC msg=audit(1260289801.448:70566): avc:  denied  { read write } for  pid=18495 comm="postdrop" path="socket:[12414117]" dev=sockfs ino=12414117 scontext=root:system_r:postfix_postdrop_t:s0-s0:c0.c1023 tcontext=system_u:system_r:rpm_t:s0 tclass=tcp_socket
type=AVC msg=audit(1260289801.448:70566): avc:  denied  { read write } for  pid=18495 comm="postdrop" path="socket:[12414123]" dev=sockfs ino=12414123 scontext=root:system_r:postfix_postdrop_t:s0-s0:c0.c1023 tcontext=system_u:system_r:rpm_t:s0 tclass=tcp_socket
type=AVC msg=audit(1260289801.448:70566): avc:  denied  { read write } for  pid=18495 comm="postdrop" path="socket:[12414130]" dev=sockfs ino=12414130 scontext=root:system_r:postfix_postdrop_t:s0-s0:c0.c1023 tcontext=system_u:system_r:rpm_t:s0 tclass=tcp_socket
type=AVC msg=audit(1260289801.448:70566): avc:  denied  { read write } for  pid=18495 comm="postdrop" path="socket:[12414136]" dev=sockfs ino=12414136 scontext=root:system_r:postfix_postdrop_t:s0-s0:c0.c1023 tcontext=system_u:system_r:rpm_t:s0 tclass=tcp_socket
type=AVC msg=audit(1260289801.448:70566): avc:  denied  { read write } for  pid=18495 comm="postdrop" path="socket:[12414142]" dev=sockfs ino=12414142 scontext=root:system_r:postfix_postdrop_t:s0-s0:c0.c1023 tcontext=system_u:system_r:rpm_t:s0 tclass=tcp_socket
type=AVC msg=audit(1260289801.448:70566): avc:  denied  { read write } for  pid=18495 comm="postdrop" path="socket:[12414148]" dev=sockfs ino=12414148 scontext=root:system_r:postfix_postdrop_t:s0-s0:c0.c1023 tcontext=system_u:system_r:rpm_t:s0 tclass=tcp_socket
type=AVC msg=audit(1260289801.448:70566): avc:  denied  { read write } for  pid=18495 comm="postdrop" path="socket:[12414155]" dev=sockfs ino=12414155 scontext=root:system_r:postfix_postdrop_t:s0-s0:c0.c1023 tcontext=system_u:system_r:rpm_t:s0 tclass=tcp_socket
type=AVC msg=audit(1260289801.448:70566): avc:  denied  { read write } for  pid=18495 comm="postdrop" path="socket:[12414162]" dev=sockfs ino=12414162 scontext=root:system_r:postfix_postdrop_t:s0-s0:c0.c1023 tcontext=system_u:system_r:rpm_t:s0 tclass=tcp_socket
type=AVC msg=audit(1260289801.448:70566): avc:  denied  { read write } for  pid=18495 comm="postdrop" path="socket:[12414168]" dev=sockfs ino=12414168 scontext=root:system_r:postfix_postdrop_t:s0-s0:c0.c1023 tcontext=system_u:system_r:rpm_t:s0 tclass=tcp_socket
type=AVC msg=audit(1260289801.448:70566): avc:  denied  { read write } for  pid=18495 comm="postdrop" path="socket:[12414186]" dev=sockfs ino=12414186 scontext=root:system_r:postfix_postdrop_t:s0-s0:c0.c1023 tcontext=system_u:system_r:rpm_t:s0 tclass=tcp_socket
type=AVC msg=audit(1260289801.448:70566): avc:  denied  { read write } for  pid=18495 comm="postdrop" path="socket:[12414192]" dev=sockfs ino=12414192 scontext=root:system_r:postfix_postdrop_t:s0-s0:c0.c1023 tcontext=system_u:system_r:rpm_t:s0 tclass=tcp_socket
type=AVC msg=audit(1260289801.448:70566): avc:  denied  { read write } for  pid=18495 comm="postdrop" path="socket:[12414198]" dev=sockfs ino=12414198 scontext=root:system_r:postfix_postdrop_t:s0-s0:c0.c1023 tcontext=system_u:system_r:rpm_t:s0 tclass=tcp_socket
type=AVC msg=audit(1260289801.448:70566): avc:  denied  { read write } for  pid=18495 comm="postdrop" path="socket:[12414209]" dev=sockfs ino=12414209 scontext=root:system_r:postfix_postdrop_t:s0-s0:c0.c1023 tcontext=system_u:system_r:rpm_t:s0 tclass=tcp_socket
type=AVC msg=audit(1260289801.448:70566): avc:  denied  { read write } for  pid=18495 comm="postdrop" path="socket:[12414225]" dev=sockfs ino=12414225 scontext=root:system_r:postfix_postdrop_t:s0-s0:c0.c1023 tcontext=system_u:system_r:rpm_t:s0 tclass=tcp_socket

What does it mean?
This User Gave Thanks to mojoman For This Post:
Fish50034
# 2  
Old 12-09-2009
Which OS? Did you look into the documentation for it?
 
Login or Register to Ask a Question

Previous Thread | Next Thread

9 More Discussions You Might Find Interesting

1. UNIX for Beginners Questions & Answers

Audit details

Hi All , I'm a fresher and don't have much knowledge on scripting. I want to extract log details like count of rows inserted , job start time and end time from Datastage log and want to insert into table. Can you please me in this (2 Replies)
Discussion started by: Srikavya_manda
2 Replies

2. Programming

Version control for audit

Hi.I am running some scripts from a "scripts" directory for my job (I am working in Financial industry).For compliance purposes I need to use a "release" directory when running them using some sort of version control(CVS,SVN or GIT) in case the program is audited.Basically I have to maintain a dev... (0 Replies)
Discussion started by: rolleikid
0 Replies

3. Solaris

how to configure a audit in global zone that will audit all the zone

Hi everyone, how i can configure a single audit service in the global zone for all zones, on solaris BSM. I will be glad to hear back from you. Thanks and Regards (3 Replies)
Discussion started by: ladondo
3 Replies

4. AIX

When AIX audit start, How to set the /audit/stream.out file size ?

Dear All When I start the AIX(6100-06)audit subsystem. the log will save in /audit/stream.out (or /audit/trail), but in default when /audit/stream.out to grow up to 150MB. It will replace the original /audit/stream.out (or /audit/trail). Then the /audit/stream.out become empty and... (2 Replies)
Discussion started by: nnnnnnine
2 Replies

5. UNIX for Advanced & Expert Users

Audit connect

Hi, I would like to audit a connection of a specific account to HPUX and LINUX redhat O.S I need audit the IP address of the client machine , and the date&time the connection to the server has been done. Is it possible ? Thanks (1 Reply)
Discussion started by: yoavbe
1 Replies

6. Solaris

audit in solaris 10

can you please share what you use to audit what files are deleted, when files are deleted and who deleted them? thx (1 Reply)
Discussion started by: melanie_pfefer
1 Replies

7. AIX

fine grained audit control

I'm working with the audit system on aix 5.1 and 5.3 . But after lots of googling and RTFM, I can't figure out how to audit all files in a given directory rather than specifying each file individually like /etc. And how can I exclude a directory such as /var/tmp so I don't get records for every... (0 Replies)
Discussion started by: vaporlock
0 Replies

8. AIX

Need to audit LV's - need some command help

I need to run a DC wide audit of some oracle filesystems to ensure their all on SAN. In linux its pretty easy since its LVM device structure includes the VG for which that lv is part of (/dev/VGFOO/lv-bar). As such I can just run mount and do some greping to get the needed info. SO my question... (2 Replies)
Discussion started by: Mattchewie
2 Replies

9. Cybersecurity

Enabling C2 audit

hey guys, im going to enable C2 auditing on a sun box, i know how to do it, but im just wondering if there are any issues or problems that i may run into. this will be my first major change (since i have to reset the box) since i joined this company and i dont really wanna kill their servers, so... (2 Replies)
Discussion started by: roguekitton
2 Replies
Login or Register to Ask a Question