dmesg spammed by messages (audit: PROCTITLE proctitle="ebtables-restore")

B

boxieee

Member
Feb 16, 2023
46
3
13
Dmesg is being spammed by auit nonstop today, any input how to rectify this



Aug 18 17:05:39 Prox1 audit[2342]: NETFILTER_CFG table=filter family=7 entries=0 op=xt_replace pid=2342 subj=unconfined comm="ebtables-restor"
Aug 18 17:05:39 Prox1 audit[2342]: SYSCALL arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5d6054eede60 items=0 ppid=1248 pid=2342 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ebtables-restor" exe="/usr/sbin/ebtables-legacy-restore" subj=unconfined key=(null)
Aug 18 17:05:39 Prox1 audit: PROCTITLE proctitle="ebtables-restore"
Aug 18 17:05:49 Prox1 audit[2410]: NETFILTER_CFG table=filter family=7 entries=0 op=xt_replace pid=2410 subj=unconfined comm="ebtables-restor"
Aug 18 17:05:49 Prox1 audit[2410]: SYSCALL arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=634262edae60 items=0 ppid=1248 pid=2410 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ebtables-restor" exe="/usr/sbin/ebtables-legacy-restore" subj=unconfined key=(null)
Aug 18 17:05:49 Prox1 audit: PROCTITLE proctitle="ebtables-restore"
Aug 18 17:05:59 Prox1 audit[2458]: NETFILTER_CFG table=filter family=7 entries=0 op=xt_replace pid=2458 subj=unconfined comm="ebtables-restor"
Aug 18 17:05:59 Prox1 audit[2458]: SYSCALL arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5601d705fe60 items=0 ppid=1248 pid=2458 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ebtables-restor" exe="/usr/sbin/ebtables-legacy-restore" subj=unconfined key=(null)
Aug 18 17:05:59 Prox1 audit: PROCTITLE proctitle="ebtables-restore"
Aug 18 17:06:09 Prox1 audit[2496]: NETFILTER_CFG table=filter family=7 entries=0 op=xt_replace pid=2496 subj=unconfined comm="ebtables-restor"
Aug 18 17:06:09 Prox1 audit[2496]: SYSCALL arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=60bd9dbe4e60 items=0 ppid=1248 pid=2496 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ebtables-restor" exe="/usr/sbin/ebtables-legacy-restore" subj=unconfined key=(null)
Aug 18 17:06:09 Prox1 audit: PROCTITLE proctitle="ebtables-restore"
Aug 18 17:06:19 Prox1 audit[2536]: NETFILTER_CFG table=filter family=7 entries=0 op=xt_replace pid=2536 subj=unconfined comm="ebtables-restor"
Aug 18 17:06:19 Prox1 audit[2536]: SYSCALL arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5b16b206ae60 items=0 ppid=1248 pid=2536 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ebtables-restor" exe="/usr/sbin/ebtables-legacy-restore" subj=unconfined key=(null)
Aug 18 17:06:19 Prox1 audit: PROCTITLE proctitle="ebtables-restore"
Aug 18 17:06:29 Prox1 audit[2604]: NETFILTER_CFG table=filter family=7 entries=0 op=xt_replace pid=2604 subj=unconfined comm="ebtables-restor"
Aug 18 17:06:29 Prox1 audit[2604]: SYSCALL arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=581b6f276e60 items=0 ppid=1248 pid=2604 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ebtables-restor" exe="/usr/sbin/ebtables-legacy-restore" subj=unconfined key=(null)
Aug 18 17:06:29 Prox1 audit: PROCTITLE proctitle="ebtables-restore"
Aug 18 17:06:30 Prox1 kernel: x86/split lock detection: #AC: CPU 0/KVM/1637 took a split_lock trap at address: 0xfffff8062606700a
Aug 18 17:06:39 Prox1 audit[2652]: NETFILTER_CFG table=filter family=7 entries=0 op=xt_replace pid=2652 subj=unconfined comm="ebtables-restor"
Aug 18 17:06:39 Prox1 audit[2652]: SYSCALL arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5aacfabc1e60 items=0 ppid=1248 pid=2652 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ebtables-restor" exe="/usr/sbin/ebtables-legacy-restore" subj=unconfined key=(null)
Aug 18 17:06:39 Prox1 audit: PROCTITLE proctitle="ebtables-restore"
Aug 18 17:06:49 Prox1 audit[2696]: NETFILTER_CFG table=filter family=7 entries=0 op=xt_replace pid=2696 subj=unconfined comm="ebtables-restor"
Aug 18 17:06:49 Prox1 audit[2696]: SYSCALL arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=579cb6e81e60 items=0 ppid=1248 pid=2696 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ebtables-restor" exe="/usr/sbin/ebtables-legacy-restore" subj=unconfined key=(null)
Aug 18 17:06:49 Prox1 audit: PROCTITLE proctitle="ebtables-restore"
Aug 18 17:06:59 Prox1 audit[2725]: NETFILTER_CFG table=filter family=7 entries=0 op=xt_replace pid=2725 subj=unconfined comm="ebtables-restor"
Aug 18 17:06:59 Prox1 audit[2725]: SYSCALL arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=6490385e6e60 items=0 ppid=1248 pid=2725 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ebtables-restor" exe="/usr/sbin/ebtables-legacy-restore" subj=unconfined key=(null)
Aug 18 17:06:59 Prox1 audit: PROCTITLE proctitle="ebtables-restore"
Aug 18 17:07:09 Prox1 audit[2797]: NETFILTER_CFG table=filter family=7 entries=0 op=xt_replace pid=2797 subj=unconfined comm="ebtables-restor"
Aug 18 17:07:09 Prox1 audit[2797]: SYSCALL arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5af7a6717e60 items=0 ppid=1248 pid=2797 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ebtables-restor" exe="/usr/sbin/ebtables-legacy-restore" subj=unconfined key=(null)
Aug 18 17:07:09 Prox1 audit: PROCTITLE proctitle="ebtables-restore"
Aug 18 17:07:19 Prox1 audit[2842]: NETFILTER_CFG table=filter family=7 entries=0 op=xt_replace pid=2842 subj=unconfined comm="ebtables-restor"
Aug 18 17:07:19 Prox1 audit[2842]: SYSCALL arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5e44a0c1be60 items=0 ppid=1248 pid=2842 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ebtables-restor" exe="/usr/sbin/ebtables-legacy-restore" subj=unconfined key=(null)
Aug 18 17:07:19 Prox1 audit: PROCTITLE proctitle="ebtables-restore"
Aug 18 17:07:29 Prox1 audit[2887]: NETFILTER_CFG table=filter family=7 entries=0 op=xt_replace pid=2887 subj=unconfined comm="ebtables-restor"
Aug 18 17:07:29 Prox1 audit[2887]: SYSCALL arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5b66d0246e60 items=0 ppid=1248 pid=2887 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ebtables-restor" exe="/usr/sbin/ebtables-legacy-restore" subj=unconfined key=(null)
Aug 18 17:07:29 Prox1 audit: PROCTITLE proctitle="ebtables-restore"
Aug 18 17:07:40 Prox1 audit[2928]: NETFILTER_CFG table=filter family=7 entries=0 op=xt_replace pid=2928 subj=unconfined comm="ebtables-restor"
Aug 18 17:07:40 Prox1 audit[2928]: SYSCALL arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5ed3fe6b0e60 items=0 ppid=1248 pid=2928 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ebtables-restor" exe="/usr/sbin/ebtables-legacy-restore" subj=unconfined key=(null)
Aug 18 17:07:40 Prox1 audit: PROCTITLE proctitle="ebtables-restore"
Aug 18 17:07:49 Prox1 audit[2955]: NETFILTER_CFG table=filter family=7 entries=0 op=xt_replace pid=2955 subj=unconfined comm="ebtables-restor"
Aug 18 17:07:49 Prox1 audit[2955]: SYSCALL arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5a28ffa6de60 items=0 ppid=1248 pid=2955 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ebtables-restor" exe="/usr/sbin/ebtables-legacy-restore" subj=unconfined key=(null)
Aug 18 17:07:49 Prox1 audit: PROCTITLE proctitle="ebtables-restore"
Aug 18 17:07:59 Prox1 audit[3002]: NETFILTER_CFG table=filter family=7 entries=0 op=xt_replace pid=3002 subj=unconfined comm="ebtables-restor"
Aug 18 17:07:59 Prox1 audit[3002]: SYSCALL arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=596f1e373e60 items=0 ppid=1248 pid=3002 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ebtables-restor" exe="/usr/sbin/ebtables-legacy-restore" subj=unconfined key=(null)
Aug 18 17:07:59 Prox1 audit: PROCTITLE proctitle="ebtables-restore"
Aug 18 17:08:09 Prox1 audit[3056]: NETFILTER_CFG table=filter family=7 entries=0 op=xt_replace pid=3056 subj=unconfined comm="ebtables-restor"
Aug 18 17:08:09 Prox1 audit[3056]: SYSCALL arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5c4962938e60 items=0 ppid=1248 pid=3056 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ebtables-restor" exe="/usr/sbin/ebtables-legacy-restore" subj=unconfined key=(null)
Aug 18 17:08:09 Prox1 audit: PROCTITLE proctitle="ebtables-restore"
Aug 18 17:08:19 Prox1 audit[3103]: NETFILTER_CFG table=filter family=7 entries=0 op=xt_replace pid=3103 subj=unconfined comm="ebtables-restor"
Aug 18 17:08:19 Prox1 audit[3103]: SYSCALL arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=59ed37903e60 items=0 ppid=1248 pid=3103 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ebtables-restor" exe="/usr/sbin/ebtables-legacy-restore" subj=unconfined key=(null)
Aug 18 17:08:19 Prox1 audit: PROCTITLE proctitle="ebtables-restore"
Aug 18 17:08:29 Prox1 audit[3158]: NETFILTER_CFG table=filter family=7 entries=0 op=xt_replace pid=3158 subj=unconfined comm="ebtables-restor"
Aug 18 17:08:29 Prox1 audit[3158]: SYSCALL arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5a665d4afe60 items=0 ppid=1248 pid=3158 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ebtables-restor" exe="/usr/sbin/ebtables-legacy-restore" subj=unconfined key=(null)
Aug 18 17:08:29 Prox1 audit: PROCTITLE proctitle="ebtables-restore"
Aug 18 17:08:39 Prox1 audit[3195]: NETFILTER_CFG table=filter family=7 entries=0 op=xt_replace pid=3195 subj=unconfined comm="ebtables-restor"
Aug 18 17:08:39 Prox1 audit[3195]: SYSCALL arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=56f06b12fe60 items=0 ppid=1248 pid=3195 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ebtables-restor" exe="/usr/sbin/ebtables-legacy-restore" subj=unconfined key=(null)
Aug 18 17:08:39 Prox1 audit: PROCTITLE proctitle="ebtables-restore"
Aug 18 17:08:49 Prox1 audit[3242]: NETFILTER_CFG table=filter family=7 entries=0 op=xt_replace pid=3242 subj=unconfined comm="ebtables-restor"
Aug 18 17:08:49 Prox1 audit[3242]: SYSCALL arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5b82bfbbce60 items=0 ppid=1248 pid=3242 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ebtables-restor" exe="/usr/sbin/ebtables-legacy-restore" subj=unconfined key=(null)
Aug 18 17:08:49 Prox1 audit: PROCTITLE proctitle="ebtables-restore"
Aug 18 17:08:59 Prox1 audit[3288]: NETFILTER_CFG table=filter family=7 entries=0 op=xt_replace pid=3288 subj=unconfined comm="ebtables-restor"
Aug 18 17:08:59 Prox1 audit[3288]: SYSCALL arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5d0cc661fe60 items=0 ppid=1248 pid=3288 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ebtables-restor" exe="/usr/sbin/ebtables-legacy-restore" subj=unconfined key=(null)
Aug 18 17:08:59 Prox1 audit: PROCTITLE proctitle="ebtables-restore"
Aug 18 17:09:09 Prox1 audit[3365]: NETFILTER_CFG table=filter family=7 entries=0 op=xt_replace pid=3365 subj=unconfined comm="ebtables-restor"
Aug 18 17:09:09 Prox1 audit[3365]: SYSCALL arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5bb26bcade60 items=0 ppid=1248 pid=3365 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ebtables-restor" exe="/usr/sbin/ebtables-legacy-restore" subj=unconfined key=(null)
Aug 18 17:09:09 Prox1 audit: PROCTITLE proctitle="ebtables-restore"
Aug 18 17:09:19 Prox1 audit[3389]: NETFILTER_CFG table=filter family=7 entries=0 op=xt_replace pid=3389 subj=unconfined comm="ebtables-restor"
Aug 18 17:09:19 Prox1 audit[3389]: SYSCALL arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=58af14419e60 items=0 ppid=1248 pid=3389 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ebtables-restor" exe="/usr/sbin/ebtables-legacy-restore" subj=unconfined key=(null)
Aug 18 17:09:19 Prox1 audit: PROCTITLE proctitle="ebtables-restore"
 
Hi there,

Have you ever found a solution to this? I recently upgraded from Proxmox 8 to 9 on one of my nodes and dmesg is unusable...

Thanks,

D.
 
This is frustrating I researched this and found that there doesn't seem to be a way to filter out these messages because they are syscall messages,
You cannot put a syscall rule on an exclude list because syscall rules are evaluated at syscall exit and are not part of the file system event stream that the exclude list filters.

Currently the only way to handle this is to:

1: use an exclusion grep on the audit log.
tail -f /var/log/audit/audit.log | grep -v ebtables
This will exclude all ebtables events.



2: filter the rule itself using executable name to create a keyword that you can then filter using ausearch.
the caveat with this is that ausearch does not have an exclude option.
to do this:
create a file
/etc/audit/rules.d/ebtables.rules
and add
-a always,exit -F arch=b64 -S execve -F exe=/usr/sbin/ebtables-restore -k ebtables_log
-a always,exite -F arch=b64 -S execve -F exe=/usr/sb/in/ebtables-legacy-restore -k ebtables_log

Then reload the audit log
augenrules --load

This will enable you to search for the ebtables events using
ausearch -k ebtables_log


I would like a way to filter these to a completely separate log so I don't have to run my tail using grep -v to filter out garbage like ebtables spamming.
 
I had an interesting experience with auditing. First off, I have to note that `auditd` wasn't installed on any of my Hypervisors, but I installed it on one to do some troubleshooting. I enabled auditing and then pretty quickly got spammed. Thinking purging will help the matter, it didn't. Then re-installed auditd, did do anything, and the spamming is gone. Really strange.
 
jalbrizio said:
This is frustrating I researched this and found that there doesn't seem to be a way to filter out these messages because they are syscall messages,
You cannot put a syscall rule on an exclude list because syscall rules are evaluated at syscall exit and are not part of the file system event stream that the exclude list filters.
Click to expand...

Holy thread resurrection. Wondering if you ever made any headway with this but it is definitely possible to filter out. I wouldn't know if this would have worked at the time of your original post, maybe package capabilities changed, literally no idea.

Anyhow, I got fed up with audit log being spammed. First consideration was CIS benchmarking so stripped all that, still occured with default ruleset. Confirmed this spinning up a new Proxmox and installing auditd fresh - soon as auditd installed the logs were being spammed.

I also followed the audit log whilst making firewall changes. There is nothing "useful" in the logs, indicating a change has occured, simply that the ebtables script has run (see log further down).

From auditd documentation: In auditd rules, if a particular event should not trigger generation of a log then the rule is defined as -a always,exclude or -a never,exit.

For my platform, I have therefore created a rule to discard these entries entirely from the audit log, thus silencing the spamming. I've been through several months of logs and I see nothing of value besides these repeated entries. I am open to anybody shedding more light if this is not the correct way to go about it.

Code: 
# Proxmox silence ebtables every second
-a always,exclude -F msgtype=NETFILTER_CFG

Lastly, I have a feeling that what its actually whinging about is not that a script was run, its classed as "unconfined" ie not subject to any apparmor rules. I am researching to see if anything better can be done manipulating apparmor instead of discarding from log.

As always, others mileage may vary but the above is what I did on my platform to shut it up. Happy Proxmox!


Before making configuration change, logs spammed:
Code: 
...
type=PROCTITLE msg=audit(1793939669.798:1284): proctitle="ebtables-restore"
type=NETFILTER_CFG msg=audit(1793939679.903:1285): table=filter family=7 entries=0 op=xt_replace pid=739048 subj=unconfined comm="ebtables-restor"
type=SYSCALL msg=audit(1793939679.903:1285): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5c9864351e60 items=0 ppid=653914 pid=739048 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ebtables-restor" exe="/usr/sbin/ebtables-legacy-restore" subj=unconfined key=(null)ARCH=x86_64 SYSCALL=setsockopt AUID="unset" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root"
...


Immediately at the point of making firewall change and a few seconds after, same logs nothing to indicate a "change" as such:
Code: 
...
type=NETFILTER_CFG msg=audit(1793939699.236:1287): table=filter family=7 entries=0 op=xt_replace pid=739092 subj=unconfined comm="ebtables-restor"
type=SYSCALL msg=audit(1793939699.236:1287): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5b9126b0ae60 items=0 ppid=653914 pid=739092 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ebtables-restor" exe="/usr/sbin/ebtables-legacy-restore" subj=unconfined key=(null)ARCH=x86_64 SYSCALL=setsockopt AUID="unset" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root"
type=PROCTITLE msg=audit(1793939699.236:1287): proctitle="ebtables-restore"
type=NETFILTER_CFG msg=audit(1793940059.904:1330): table=filter family=7 entries=0 op=xt_replace pid=739943 subj=unconfined comm="ebtables-restor"
type=SYSCALL msg=audit(1793940059.904:1330): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5c17a7959e60 items=0 ppid=653914 pid=739943 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ebtables-restor" exe="/usr/sbin/ebtables-legacy-restore" subj=unconfined key=(null)ARCH=x86_64 SYSCALL=setsockopt AUID="unset" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root"
type=PROCTITLE msg=audit(1793940059.904:1330): proctitle="ebtables-restore"
type=NETFILTER_CFG msg=audit(1793940070.009:1331): table=filter family=7 entries=0 op=xt_replace pid=739968 subj=unconfined comm="ebtables-restor"
type=SYSCALL msg=audit(1793940070.009:1331): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=585afb966e60 items=0 ppid=653914 pid=739968 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ebtables-restor" exe="/usr/sbin/ebtables-legacy-restore" subj=unconfined key=(null)ARCH=x86_64 SYSCALL=setsockopt AUID="unset" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root"
type=PROCTITLE msg=audit(1793940070.009:1331): proctitle="ebtables-restore"
...
 
Last edited:
You must log in or register to reply here.
Top Bottom
Back