Linux-audit Archive on
 help / color / Atom feed
* httpd auid = -1
@ 2020-07-30 17:54 Todd Heberlein
  2020-07-30 18:29 ` Steve Grubb
  0 siblings, 1 reply; 4+ messages in thread
From: Todd Heberlein @ 2020-07-30 17:54 UTC (permalink / raw)
  To: Linux-audit

I’ve noticed that the httpd process on a CentOS 7.7 system I am working with is running with an Audit ID of -1. Example ID values are:


So if use the standard filter "-F auid!=-1” in the audit rules I do not see httpd activity.

Is this common?

How do I change the auid to something else, so I can capture the httpd activity in the audit log?

Example audit line:

type=SYSCALL msg=audit(1596065566.721:31357): arch=c000003e syscall=2 success=yes exit=15 a0=55a0a2d9b3c0 a1=80000 a2=0 a3=7ffe5d4d6720 items=1 ppid=1130 pid=1253 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" key=(null)



Linux-audit mailing list

^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, back to index

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-07-30 17:54 httpd auid = -1 Todd Heberlein
2020-07-30 18:29 ` Steve Grubb
2020-07-30 18:47   ` Todd Heberlein
2020-07-30 21:41     ` Steve Grubb

Linux-audit Archive on

Archives are clonable:
	git clone --mirror linux-audit/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-audit linux-audit/ \
	public-inbox-index linux-audit

Example config snippet for mirrors

Newsgroup available over NNTP:

AGPL code for this site: git clone