2

I have tried systemctl status setroubleshootd.service, but I get

● setroubleshootd.service
Loaded: not-found (Reason: No such file or directory)
Active: inactive (dead)

Neither does setroubleshootd appear in the output of ps ax.

However, yum info setroubleshoot, tells that the package is installed.

Installed Packages
Name        : setroubleshoot
Arch        : x86_64
Version     : 3.2.24
Release     : 1.1.el7
Size        : 235 k
Repo        : installed
From repo   : anaconda

In the same way, yum info setroubleshoot-server tells that such package is also installed.

So, it seems to be installed, but not recognized by systemd. How can I see whether it is running or not? And, if it is not running, how to enable it?

  • Have you tried: "ps -ef | grep -i setroubleshoot" ? – user116878 Jul 7 '16 at 12:23
3

Found it. The problem is that setroubleshootd does not run permanently in CentOS 7. It is started only when an AVC denial message reaches auditd. This is confusing, since you normally expect a daemon to constantly run in the background.

See: SELinux User's and Administrator's Guide: Which Log File is Used

  • The sequence seems to be: kernel signals auditd, which invokes audispd, which invokes sedispatch (as configured in /etc/audisp/plugins.d/sedispatch.conf), which formats the SELinux AVC record and sends a DBUS message to DBUS, which starts setroubleshootd under user "setroubleshoot" if it is not running. setroubleshootd receives the DBUS message, formats/preprocesses according to plugins, emits a syslog message which by default ends up in /var/log/messages and signals (via DBUS) interested client programs like sealert that something is up. – David Tonhofer Mar 22 '18 at 15:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.