How to identify failed syscalls
Running aureport gives me a lot of failed syscalls. How do I identify what syscalls are failing and what is calling them?
Thanks!
Leam
Signature · 2 lines
http://31challenge.net http://31challenge.net/insight
Quoted 2 lines · Leam Hall
Running aureport gives me a lot of failed syscalls. How do I identify what syscalls are failing and what is calling them?
Aureport's purpose is to give summary information. Ausearch gives detailed information. To get what syscalls are failing, you can just run the "--syscall --summary" report. To se what is calling them is a bit trickier. You can isolate the events with ausearch and then pipe them to aureport for summarizing:
ausearch --start today -m syscall -sv no --raw | aureport -x --summary
If you need to seethe individual events, then
ausearch --start today -m syscall -sv no -i
-Steve