The AUDIT_KERNEL event is not following name=value format. This causes
some information to get lost. The event has been reformatted to follow
the convention. Additionally the audit_enabled value was added for
troubleshooting purposes. The following is an example of the new event:

type=KERNEL audit(1480621249.833:1): state=initialized audit_enabled=0 res=1

Signed-off-by: sgrubb <sgr...@redhat.com>
---
 kernel/audit.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/kernel/audit.c b/kernel/audit.c
index 910a7c1..91860d4 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -1252,7 +1252,9 @@ static int __init audit_init(void)
        audit_enabled = audit_default;
        audit_ever_enabled |= !!audit_default;
 
-       audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL, "initialized");
+       audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL,
+               "state=initialized audit_enabled=%u res=1",
+                audit_enabled);
 
        for (i = 0; i < AUDIT_INODE_BUCKETS; i++)
                INIT_LIST_HEAD(&audit_inode_hash[i]);
-- 
2.7.4


--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit

Reply via email to