[Apparmor-general] My AA is loging to syslog instead of /var/log/audit/audit.log [solved]

[Steve Beattie]

On Fri, Feb 01, 2008 at 10:30:00AM +0100, Carlos E. R. wrote:
> The Friday 2008-02-01 at 03:18 +0100, I wrote:
> 
> >>  nimrodel:~ # rcauditd start
> >>  Starting auditd startproc:  exit status of parent of /sbin/auditd: 6
> >>
> >>  nimrodel:~ # rcauditd status
> >>  Checking for service auditd             unussed
> 
> I know why I didn't notice: the 'rcauditd start' did not report "failed". 
> There is no red "failed" services at the bottom of the list of services in 
> console one.

What version of auditd are you running (rpm -q audit)? What are the
permissions on /var/log/audit/audit.log? Is there anything useful in
syslog about it?

(If you're running the openSUSE 10.2 update
version of auditd, this not-a-bug may be relevant:
https://bugzilla.novell.com/show_bug.cgi?id=273409)

-- 
Steve Beattie
<steve at nxnw.org>
http://NxNW.org/~steve/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 194 bytes
Desc: not available
Url : http://forge.novell.com/pipermail/apparmor-general/attachments/20080206/2c0fd2d2/attachment.pgp