audctl ERRNO returned

[Jane Lecian]

Hello All,

About a month ago, I converted a test system to a Trusted System. In reviewing the audit logs for the admin category, I get a failure for event=audctl. This error occurred only for 1 day and then cleared up. I am trying to figure out what caused it. The only information that the log gives is "ERRNO =2; RETURN_VALUE 1 = -1;". Does anyone know where I could look up the ERRNO for audctl? Attached is an example of the full audit log message.

Thanks,

Jane

[Dietmar Konermann · Accepted solution]

Errno 2 is ENOENT, "No such file or directory". See /usr/include/sys/errno.h.

From man audctl(2):

[ENOENT]
No available "next" file when cmd is AUD_GETNEXT or AUD_SWITCH.

Best regards...
Dietmar.

[Jane Lecian]

Thank you for the great response.

Jane