Skip to content

BUG: audit init message shows 0-second timestamp on aarch64 #155

Description

@rgbriggs

First audit message, audit initialization, on aarch64, has zero-second timestamp. The msec counter appears to be running. It appears audit is initialized before the system clock.

Ex:
audit: type=2000 audit(0.360:1): state=initialized audit_enabled=0 res=1
audit: type=1403 audit(1692710902.940:3): auid=4294967295 ses=4294967295 lsm=selinux res=1
audit: type=1305 audit(1692710990.312:85): op=set audit_enabled=1 old=1 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditd_t:s0 res=1

Expected results:
The problem was discovered because logwatch does not match these lines, expecting more digits in the parentheses. This assumption works elsewhere but not on aarch64.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions