On Tue, 14 Apr 2020 11:26:57 +1000 Russell Coker
wrote:
> On Saturday, 11 April 2020 5:19:00 PM AEST Michael Biebl wrote:
> > > type=AVC msg=audit(1586512443.135:71139): avc: granted { unlink
} for
> > > pid=293 comm="systemd-journal"
> > > name="
On Saturday, 11 April 2020 5:19:00 PM AEST Michael Biebl wrote:
> > type=AVC msg=audit(1586512443.135:71139): avc: granted { unlink } for
> > pid=293 comm="systemd-journal"
> > name="user-1001@165b61313e51499ab58ffd33d611e714--
> > .journal" dev="sdb2" ino=2093618
Am 11.04.20 um 05:30 schrieb Russell Coker:
> On Friday, 10 April 2020 9:30:20 PM AEST Michael Biebl wrote:
Can you find out, how the file was deleted?
>>>
>>> systemd-journald just decided to do it.
>>>
>>> I'll put in an audit entry to get an audit log of it.
>>
>> Any news here?
>
> Yes
On Friday, 10 April 2020 9:30:20 PM AEST Michael Biebl wrote:
> > > Can you find out, how the file was deleted?
> >
> > systemd-journald just decided to do it.
> >
> > I'll put in an audit entry to get an audit log of it.
>
> Any news here?
Yes it's systemd-journald deleting the files.
On Wed, 25 Mar 2020 17:25:18 +1100 Russell Coker
wrote:
> On Wednesday, 25 March 2020 3:23:55 PM AEDT Michael Biebl wrote:
> > > root@sevm:~# grep dele /proc/293/maps
> > > 7fca8e8ef000-7fca8f0ef000 rw-s 00:15 2013277
> > > /var/
On Wednesday, 25 March 2020 3:23:55 PM AEDT Michael Biebl wrote:
> > root@sevm:~# grep dele /proc/293/maps
> > 7fca8e8ef000-7fca8f0ef000 rw-s 00:15 2013277
> > /var/ log/journal/68f1b89bf8c73b0ed9ed905f535fa641/
> >
I created a user on the 21st of March, logged in a couple of times, then
didn't use that account again. Now on the 25th of March I have a mapped
deleted file. The command "journalctl --rotate" fixes the problem.
root@sevm:~# last|grep test
test pts/1103.75.204.226 Sat Mar 21
Am 25.03.20 um 05:18 schrieb Russell Coker:
> I created a user on the 21st of March, logged in a couple of times, then
> didn't use that account again. Now on the 25th of March I have a mapped
> deleted file. The command "journalctl --rotate" fixes the problem.
>
> root@sevm:~# last|grep test
8 matches
Mail list logo