5

I have SELinux in permissive mode enabled on CentOS7 system. But it doesn't seem to produce any logs. No new files in /var/log/audit, grep -i selinux /var/log/messages* finds nothing.

sestatus returns:

SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   permissive
Mode from config file:          permissive
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Max kernel policy version:      28

What can be wrong?

1 Answer 1

7

Do you have the audit packages installed? If so, is auditd enabled and running?

When you don't have the audit packages installed, audit & audit-libs and have the auditd service running, the logs will stop showing up in where you expect (/var/log/audit). When this is the case, they will show up in /var/log/messages.

4
  • 2
    I have auditd running, but no new logs in /var/log/audit. I tried restarting the service with systemctl, but got this: Operation refused, unit auditd.service may be requested by dependency only. Feb 5, 2016 at 6:53
  • 3
    That is correct. Audit, unfortunately, does not play well enough with systemd. Use the classic service command for auditd and it will restart gracefully.
    – Sokel
    Feb 6, 2016 at 4:03
  • 2
    Allright, restarting it this way helped, thanks! Feb 6, 2016 at 6:03
  • 1
    "Where do the AVC (Access Vector Cache) denials go to?" Doc for Red Hat 6, Doc for Red Hat 7 Mar 21, 2018 at 18:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .