Re: sealert and FC17

[Frank Murphy <frankly3d@xxxxxxxxx>]

On 03/08/12 16:50, m.roth@xxxxxxxxx wrote:

> > Are you trying to find avc's in the audit.log?
> > sudo ausearch -m avc
>
> Nothing. All my avc's seem to be in messages, and I'm not getting what I
> used to get, the line with "run sealert ..." to move it to something
> comprehensible. With the examples, above, I don't know what the ID is,
> either.
>
>          mark

Is the audit service running?
systemctl status auditd.service
If is disabled try:
systemctl enable auditd.service
systemctl start auditd.service


--
Regards,
Frank
"Jack of all, fubars"
--
selinux mailing list
selinux@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/selinux