Thanks to everybody for their help. Eric,
That file, /usr/include/asm-generic/errno-base.h, was exactly what I was looking for. Thanks! Chad Vaughn -----Original Message----- From: Eric Paris [mailto:[email protected]] Sent: Wednesday, May 01, 2013 3:45 PM To: Peter Moody Cc: Vaughn, Chad M; [email protected] Subject: EXTERNAL: Re: explanation/translation of auditd exit codes ausearch -i at least translates them into their posix names.... checking out /usr/include/asm-generic/errno-base.h shows: #define EEXIST 17 /* File exists */ But if you use -i it will do it correctly across arches, etc... ----- Original Message ----- > > > Isn't that just the return code of the syscall in question? Meaning, > you'd need to look up the syscall in the relevant include file to see > what -17 meant. Maybe auparse already does this, I'm not sure. > On May 1, 2013 12:10 PM, "Vaughn, Chad M" < [email protected] > wrote: > > > All, > > Is there a listing somewhere that explains what various exit codes in > auditd are? > > For example, we are getting some exit=-17 entries in our logs, and we > have narrowed it down to an init script that tries to create a > directory that already exists. > So, we are pretty sure exit=-17 means that a directory already exits. > > It would be nice if we knew all codes and their translation, whether > it be exit=-2, exit=-22, exit=-6, or exit=-17 and so on. > > I have yet to find that explained anywhere. Any info would be greatly > appreciated and would help us fine tune our audit.rules file. > > Chad Vaughn > > -- > Linux-audit mailing list > [email protected] > https://www.redhat.com/mailman/listinfo/linux-audit > > -- > Linux-audit mailing list > [email protected] > https://www.redhat.com/mailman/listinfo/linux-audit -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
