Details
Description
Create any error with auditd module i.e. specify a wrong folder name for audit log path.
Check memcached for errors, note that there is not indication that errors are from auditd module. Can there be some sort of indicator to identify errors that are originating from auditd, will help support to just run a trace using a keyword. Currently it prints the following:
Tue Mar 3 04:32:08.470366 PST 3: open error on file /data1//audit.log: Permission denied
Tue Mar 3 04:32:08.470436 PST 3: error opening audit file
Tue Mar 3 04:32:32.178216 PST 3: open error on file /data1//audit.log: Permission denied
Tue Mar 3 04:32:32.178310 PST 3: error opening audit file
Tue Mar 3 04:32:38.599179 PST 3: open error on file /data1//audit.log: Permission denied
Tue Mar 3 04:32:38.599250 PST 3: error opening audit file
Tue Mar 3 04:33:02.821553 PST 3: open error on file /data2//audit.log: Permission denied
Tue Mar 3 04:33:02.821627 PST 3: error opening audit file
Tue Mar 3 04:33:12.480049 PST 3: open error on file /data2//audit.log: Permission denied
Tue Mar 3 04:33:12.480130 PST 3: error opening audit file
Tue Mar 3 04:41:52.571613 PST 3: open error on file /data1/folder1/audit.log: Permission denied
Tue Mar 3 04:41:52.571648 PST 3: error opening audit file
Tue Mar 3 04:43:20.155357 PST 3: open error on file /data2/audit.log: Permission denied
Tue Mar 3 04:43:20.155446 PST 3: error opening audit file
Tue Mar 3 04:55:01.150595 PST 3: open error on file /data1/folder1/audit.log: Permission denied
Tue Mar 3 04:55:01.150630 PST 3: error opening audit file
Tue Mar 3 04:57:12.796249 PST 3: open error on file /data1/folder1/audit.log: Permission denied
Tue Mar 3 04:57:12.796314 PST 3: error opening audit file
Tue Mar 3 05:20:25.030432 PST 3: writing to disk error: No space left on device