[PATCH] drop EOE records from printk
Hi, While we are looking at the printk issue, I see that its printk'ing the EOE (end of event) records which is really not something that we need in syslog. Its really intended for the realtime audit event stream handled by the audit daemon. So, lets avoid printk'ing that record type. Signed-off-by: Steve Grubb <sgrubb@redhat.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
This commit is contained in:
parent
b29ee87e9b
commit
8d07a67cfa
|
@ -1353,16 +1353,18 @@ void audit_log_end(struct audit_buffer *ab)
|
||||||
if (!audit_rate_check()) {
|
if (!audit_rate_check()) {
|
||||||
audit_log_lost("rate limit exceeded");
|
audit_log_lost("rate limit exceeded");
|
||||||
} else {
|
} else {
|
||||||
if (audit_pid) {
|
|
||||||
struct nlmsghdr *nlh = nlmsg_hdr(ab->skb);
|
struct nlmsghdr *nlh = nlmsg_hdr(ab->skb);
|
||||||
|
if (audit_pid) {
|
||||||
nlh->nlmsg_len = ab->skb->len - NLMSG_SPACE(0);
|
nlh->nlmsg_len = ab->skb->len - NLMSG_SPACE(0);
|
||||||
skb_queue_tail(&audit_skb_queue, ab->skb);
|
skb_queue_tail(&audit_skb_queue, ab->skb);
|
||||||
ab->skb = NULL;
|
ab->skb = NULL;
|
||||||
wake_up_interruptible(&kauditd_wait);
|
wake_up_interruptible(&kauditd_wait);
|
||||||
} else if (printk_ratelimit()) {
|
} else if (nlh->nlmsg_type != AUDIT_EOE) {
|
||||||
struct nlmsghdr *nlh = nlmsg_hdr(ab->skb);
|
if (printk_ratelimit()) {
|
||||||
printk(KERN_NOTICE "type=%d %s\n", nlh->nlmsg_type, ab->skb->data + NLMSG_SPACE(0));
|
printk(KERN_NOTICE "type=%d %s\n",
|
||||||
} else {
|
nlh->nlmsg_type,
|
||||||
|
ab->skb->data + NLMSG_SPACE(0));
|
||||||
|
} else
|
||||||
audit_log_lost("printk limit exceeded\n");
|
audit_log_lost("printk limit exceeded\n");
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in New Issue