I'm trying to human read /var/log/audit/audit.log file on centos7. I came with command

sealert -a /var/log/audit/audit.log

which works fine on one machine, there is initial scan which takes second or so, but on another one scan goes on for about 30 minutes and is still on 40%. It cannot be stopped by ctrl-c. I also tried to remove audit.log so it's almost empty but there was no speedup.

Both of these machines are virtual and run on same host

I found out that many alerts were generated by my apache, so I disabled selinux using

setenforce 0

and removed old audit.log.X files but its still same slow (and keeps slowing so it might never finish) sealert process is using one core permanently at 25% of CPU and 1gig of RAM.

is there any other way I can analyze selinux log files from cli ?

  • 3
    Yes, pipe your audit.log to audit2allow to see what rules or booleans it would suggest enabling or creating. That should return almost instantly.
    – Aaron
    Oct 10 '16 at 22:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.