Auditing doesnt work.

[Pazzie]

Hello,

Im using kernel 2.4.19 with the grsecurity patch and almost eveything seems to work just fine, (thank you for creating such great and free product)

However, the auditing on group level doesnt work, i have created a group like gredit:x:1007:user1 so that everyhting from that user must be logged, at least that should grsecure supose to do. But nothing happend.

Not a single entry in my logfiles, what could be the problem??

[spender]

Are kernel logs of level INFO being logged to a file by syslog? Check your /etc/syslog.conf file to find out. Auditing logs aren't logged the same way as security alerts.

-Brad

[Pazzie]

*.info /var/log/grsec

Thats what i have in the syslog.conf, however iim getting a huge log file.
But there is still no grsec-auditing, strange thing is when i boot my pc i get
some kinda error with IOCTL TIOCGDEV unknown by Kernel, must the kernel be prepared for auditing or must i add an extra patch ?.

[spender]

auditing should automatically work. What auditing options did you select?

-Brad

[Pazzie]

Single group for auditing
(1007) GID for auditing


Thats it!

[spender]

I thought so If you read the documentation for that option, you would see that you also have to enable some auditing features below that. That feature just simply chooses whether you want to audit the features below for everyone, or for a single group.

-Brad