Dumping And Viewing Logs - Red Hat ENTERPRISE LINUX 5 - DEPLOYMENT Deployment Manual

Jan 15 08:03:56 hostname kernel: audit(1105805036.075:2392892): \
syscall=195 exit=4294967283 a0=9ef88e0 a1=bfecc0d4 a2=a97ff4 \
a3=bfecc0d4 items=1 pid=2239 loginuid=-1 uid=48 gid=48 euid=48 \
suid=48 fsuid=48 egid=48 sgid=48 fsgid=48
The following message provides more information about the target:
Jan 15 08:03:56 hostname kernel: audit(1105805036.075:2392892): \
item=0 name=/home/auser/public_html inode=921135 dev=00:00
The serial number stamp is always identical for a particular audited event. The time stamp may or may
not be identical.
Note
If you are using an audit daemon for troubleshooting, the daemon may capture audit
messages into a location other than /var/log/messages, such as /var/log/audit/
audit.log.

45.3.2. Dumping and Viewing Logs

The Red Hat Enterprise Linux 5 implementation of SELinux routes AVC audit messages to /var/
log/messages. You can use any of the standard search utilities (for example, grep), to search for
lines containing avc or audit.
Dumping and Viewing Logs
769