On my desktop I get a GNOME notification when an SELinux violation has occurred which makes debugging simple but for servers I do not have this. Is there any way I can set up SELinux so when there is a violation it sends me an email with the details?

NOTE: I have a couple (2) servers that I'd want to deploy this on

  • Yes, setroubleshoot can send email as described in this FAQ. – tonioc Jul 15 '18 at 13:53

Based on one of the comments regarding setroubleshoot you can install this extra package like so:

$ sudo yum install -y setroubleshoot

Once installed take a look at its config file, specifically this section:

# recipients_filepath: Path name of file with email recipients. One address
# per line, optionally followed by enable flag. Comment character is #.
recipients_filepath = /var/lib/setroubleshoot/email_alert_recipients

Now go ahead and create that file referenced:

$ echo "myemail@mydom.com" > /var/lib/setroubleshoot/email_alert_recipients

Then restart/start the service:

$ sudo systemctl start setroubleshoot

Advanced options

setroubleshoot also provides the ability to filter the SE alerts through the email_alert_recipients file:

jdennis@redhat.com                       filter_type=after_first

These filters are a bit hard to gleam from the docs but they go as follows:

  • Ignore After First Alert::

    • This is the default. The address will receive an alert only the first time it fires. Email alerts will be filtered for the alert in question for all subsequent firings of the alert.
  • Never Ignore::

    • An email alert will be sent for every instance of every alert to this address.
  • Ignore Always::

    • Email alerts will never be sent for this address. One can use this to temporarily disable alerts to an address.

      But I don't have a desktop session on the node I want to receive email alerts for? For instance how can I monitor a server?

      You can directly edit the file /var/lib/setroubleshoot/email_alert_recipients. This is the file the above GUI is modifying. The format of the file is line based, the hash (#) character is the comment character, the comment extends to the end of the line, blank lines are ignored.

  • NOTE: Addresses are one per line, optionally following the address (separated by whitespace) are options in the form name=value. Currently there is only one option:

    • filter_type:: after_first, never, or always

I heavily edited the above snippet, but tried to keep the "spirit" of this section from the FAQ.



For a couple of servers, a better way of having alerts is using the logcheck package.

You install logcheck in the server side, and define rules to process and send you email over the intended rules that you want to trigger emails.

In that way, if tomorrow you need other rules that are not SELinux, you can add them.

logcheck already comes with a default set of rules. I used logcheck for a while when I had a smaller infra-structure of a couple of Linux servers in the past.

Obviously for sending email, you also have to have an MTA server side with a minimum of configuration for being able to send you email. Depending whether the email is internal or for gmail, you will have to setup it up differently.

For a bigger infra-structure I would advise having a central syslog server, and handling the logs on that server, however from your answer of 2 servers I wont further elaborate this point.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.