auditctl

title: auditctl(8)

text:
# auditctl(8)

## NAME
auditctl - a utility to assist controlling the kernel's audit system

## SYNOPSIS
auditctl [options]

## DESCRIPTION
The auditctl program is used to configure kernel options related to auditing, to see status of the configuration, and to load discretionary audit rules.

## CONFIGURATION OPTIONS
-b backlog

Set max number (limit) of outstanding audit buffers allowed (Kernel Default=64) If all buffers are full, the failure flag is consulted by the kernel for action.

--backlog_wait_time wait_time

Set the time for the kernel to wait (Kernel Default 60*HZ) when the backlog limit is reached before queuing more audit events to be transferred to auditd. The number must be greater than or equal to zero and less than 10 times the default value.

--reset_backlog_wait_time_actual

Reset the actual backlog wait time counter shown by the status command.

-c

Continue loading rules in spite of an error. This summarizes the results of loading the rules. The exit code will not be success if any rule fails to load.

-D

Delete all rules and watches. This can take a key option (-k), too.

-e [0..2]

Set enabled flag. When 0 is passed, this can be used to temporarily disable auditing. When 1 is passed as an argument, it will enable auditing. To lock the audit configuration so that it can't be changed, pass a 2 as the argument. Locking the configuration is intended to be the last command in audit.rules for anyone wishing this feature to be active. Any attempt to change the configuration in this mode will be audited and denied. The configuration can only be changed by rebooting the machine.

-f [0..2]

Set failure mode 0=silent 1=printk 2=panic. This option lets you determine how you want the kernel to handle critical errors. Example conditions where this mode may have an effect includes: transmission errors to userspace audit daemon, backlog limit exceeded, out of kernel memory, and rate limit exceeded. The default value is 1. Secure environments will probably want to set this to 2.

-h, --help

Help

-i

When given by itself, ignore errors when reading rules from a file. This causes auditctl to always return a success exit code. If passed as an argument to -s then it gives an interpretation of the numbers to human readable words if possible.

--loginuid-immutable

This option tells the kernel to make loginuids unchangeable once they are set. Changing loginuids requires CAP_AUDIT_CONTROL. So, its not something that can be done by unprivileged users. Setting this makes loginuid tamper-proof, but can cause some problems in certain kinds of containers.

-q mount-point,subtree

If you have an existing directory watch and bind or move mount another subtree in the watched subtree, you need to tell the kernel to make the subtree being mounted equivalent to the directory being watched. If the subtree is already mounted at the time the directory watch is issued, the subtree is automatically tagged for watching. Please note the comma separating the two values. Omitting it will cause errors.

-r rate

Set limit in messages/sec (0=none). If this rate is non-zero and is exceeded, the failure flag is consulted by the kernel for action. The default value is 0.

--reset-lost

Reset the lost record counter shown by the status command.

-R file

Read and execute auditctl commands from a file. The commands are executed line-by-line, in the order that they appear in the file. The file must be owned by root and not readable by other users, or else it will be rejected. Empty lines are skipped. Lines starting with the '#' character are treated as comment lines. Each line is executed as if it was provided to auditctl as command line arguments. Since auditctl is the one reading the file and not a shell such as bash, do not escape special shell characters. See the EXAMPLES section for an example.

--signal signal

Send a signal to the audit daemon. You must have privileges to do this. Supported signals are TERM, HUP, USR1, USR2, CONT

and user friendly versions stop, reload, rotate, resume, state.

-t

Trim the subtrees after a mount command.

## STATUS OPTIONS
-l

List all rules 1 per line. Two more options may be given to this command. You can give either a key option (-k) to list rules that match a key or a (-i) to have a0 through a3 interpreted to help determine the syscall argument values are correct .

-m text

Send a user space message into the audit system. This can only be done if you have CAP_AUDIT_WRITE capability (normally the root user has this). The resulting event will be the USER type.

-s

Report the kernel's audit subsystem status. It will tell you the in-kernel values that can be set by -e, -f, -r, and -b options. The pid value is the process number of the audit daemon. Note that a pid of 0 indicates that the audit daemon is not running. The lost entry will tell you how many event records that have been discarded due to the kernel audit queue overflowing. The backlog field tells how many event records are currently queued waiting for auditd to read them. This option can be followed by the -i to get a couple fields interpreted.

-v

Print the version of auditctl.

## RULE OPTIONS
-a [list,action|action,list]

Append rule to the end of list with action. Please note the comma separating the two values. Omitting it will cause errors. The fields may be in either order. It could be list,action or action,list. The following describes the valid list names:

task

Add a rule to the per task list. This rule list is used only at the time a task is created -- when fork() or clone() are called by the parent task. When using this list, you should only use fields that are known at task creation time, such as the uid, gid, etc.

exit

Add a rule to the syscall exit list. This list is used upon exit from a system call to determine if an audit event should be created.

user

Add a rule to the user message filter list. This list is used by the kernel to filter events originating in user space before relaying them to the audit daemon. It should be noted that the only fields that are valid are: uid, auid, gid, pid, subj_user, subj_role, subj_type, subj_sen, subj_clr, msgtype, and executable name. All other fields will be treated as non-matching. It should be understood that any event originating from user space from a process that has CAP_AUDIT_WRITE will be recorded into the audit trail. This means that the most likely use for this filter is with rules that have an action of never since nothing has to be done to allow events to be recorded.

exclude

Add a rule to the event type exclusion filter list. This list is used to filter events that you do not want to see. For example, if you do not want to see any avc messages, you would using this list to record that. Events can be excluded by process ID, user ID, group ID, login user ID, message type, subject context, or executable name. The action is ignored and uses its default of "never".

filesystem

Add a rule that will be applied to a whole filesystem. The filesystem must be identified with a fstype field. Normally this filter is used to exclude any events for a whole filesystem such as tracefs or debugfs.

io_uring

Add a rule to the io_uring syscall filter. Rules against this filter specify the syscall operation using the -S syscall notion explained below. You can add a key field to the rule so that it may be grouped with other rules watching the same underlying syscall.

The following describes the valid actions for the rule:

never

No audit records will be generated. This can be used to suppress event generation. In general, you want suppressions at the top of the list instead of the bottom. This is because the event triggers on the first matching rule.

always

Allocate an audit context, always fill it in at syscall entry time, and always write out a record at syscall exit time.

-A list,action

Add rule to the beginning list with action.

-C [f=f | f!=f]

Build an inter-field comparison rule: field, operation, field. You may pass multiple comparisons on a single command line. Each one must start with -C. Each inter-field equation is anded with each other as well as equations starting with -F to trigger an audit record. There are 2 operators supported - equal, and not equal. Valid fields are:

auid, uid, euid, suid, fsuid, obj_uid; and gid, egid, sgid, fsgid, obj_gid

The two groups of uid and gid cannot be mixed. But any comparison within the group can be made. The obj_uid/gid fields are collected from the object of the event such as a file or directory.

-d list,action

Delete rule from list with action. The rule is deleted only if it exactly matches syscall name(s) and every field name and value.

-F [n=v | n!=v | n<v | n>v | n<=v | n>=v | n&v | n&=v]

Build a rule field: name, operation, value. You may have up to 64 fields passed on a single command line. Each one must start with -F. Each field equation is anded with each other (as well as equations starting with -C) to trigger an audit record. There are 8 operators supported - equal, not equal, less than, greater than, less than or equal, and greater than or equal, bit mask, and bit test respectively. Bit test will "and" the values and check that they are equal, bit mask just "ands" the values. Fields that take a user ID may instead have the user's name; the program will convert the name to user ID. The same is true of group names. Valid fields are:

a0, a1, a2, a3

Respectively, the first 4 arguments to a syscall. Note that string arguments are not supported. This is because the kernel is passed a pointer to the string. Triggering on a pointer address value is not likely to work. So, when using this, you should only use on numeric values. This is most likely to be used on platforms that multiplex socket or IPC operations.

arch

The CPU architecture of the syscall. The arch can be found doing 'uname -m'. If you do not know the arch of your machine but you want to use the 32 bit syscall table and your machine supports 32 bit, you can also use b32 for the arch. The same applies to the 64 bit syscall table, you can use b64. In this way, you can write rules that are somewhat arch independent because the family type will be auto detected. However, syscalls can be arch specific and what is available on x86_64, may not be available on ppc. The arch directive should precede the -S option so that auditctl knows which internal table to use to look up the syscall numbers.

auid

The original ID the user logged in with. Its an abbreviation of audit uid. Sometimes its referred to as loginuid. Either the user account text or number may be used.

devmajor

Device Major Number

devminor

Device Minor Number

dir

Full Path of Directory to watch. This will place a recursive watch on the directory and its whole subtree. It can only be used on exit list. See "-w".

egid

Effective Group ID. May be numeric or the groups name.

euid

Effective User ID. May be numeric or the user account name.

exe

Absolute path to application that while executing this rule will apply to. It supports = and != operators. Note that you can only use this once for each rule.

exit

Exit value from a syscall. If the exit code is an errno, you may use the text representation, too.

fsgid

Filesystem Group ID. May be numeric or the groups name.

fstype

File system type. This is used with the filesystem rule list. The only values supported are debugfs and tracefs.

fsuid

Filesystem User ID. May be numeric or the user account name.

filetype

The target file's type. Can be either file, dir, socket, link, character, block, or fifo.

gid

Group ID. May be numeric or the groups name.

inode

Inode Number

key

Set a filter key on an audit rule. The filter key is an arbitrary string of text that can be up to 31 bytes long. It can uniquely identify the audit records produced by a rule. Typical use is for when you have several rules that together satisfy a security requirement. The key value can be searched on with ausearch so that no matter which rule triggered the event, you can find its results. The key can also be used on delete all (-D) and list rules (-l) to select rules with a specific key. You may have more than one key on a rule if you want to be able to search logged events in multiple ways or if you have an auditd plugin that uses a key to aid its analysis.

msgtype

This is used to match the event's record type. It should only be used on the exclude or user filter lists.

obj_uid

Object's UID

obj_gid

Object's GID

obj_user

Resource's SE Linux User

obj_role

Resource's SE Linux Role

obj_type

Resource's SE Linux Type

obj_lev_low

Resource's SE Linux Low Level

obj_lev_high

Resource's SE Linux High Level

path

Insert a watch for the file system object at path. You cannot insert a watch to the top level directory. This is prohibited by the kernel. Wildcards are not supported either and will generate a warning. The way that watches work is by tracking the inode internally. This can only be used on exit list.

perm

Permission filter for file operations. Supply the access type that a file system watch will trigger on. r=read, w=write, x=execute, a=attribute change. These permissions are not the standard file permissions, but rather the kind of syscall that would do this kind of thing. The read & write syscalls are omitted from this set since they would overwhelm the logs. But rather for reads or writes, the open flags are looked at to see what permission was requested. The perm field can only be used on exit list. You can use this without specifying a syscall and the kernel will select the syscalls that satisfy the access permissions being requested. This also requires supplying an arch parameter before the perm field. This way the kernel can better determine what syscalls are needed. Not supplying an arch will result in all system calls being subject to audit. This will lower system performance.

pers

OS Personality Number

pid

Process ID

ppid

Parent's Process ID

saddr_fam

Address family number as found in /usr/include/bits/socket.h. For example, IPv4 would be 2 and IPv6 would be 10.

sessionid

User's login session ID

subj_user

Program's SE Linux User

subj_role

Program's SE Linux Role

subj_type

Program's SE Linux Type

subj_sen

Program's SE Linux Sensitivity

subj_clr

Program's SE Linux Clearance

sgid

Saved Group ID. See getresgid(2) man page.

success

If the exit value is >= 0 this is true/yes otherwise its false/no. When writing a rule, use a 1 for true/yes and a 0 for false/no

suid

Saved User ID. See getresuid(2) man page.

uid

User ID. May be numeric or the user account name.

-k key

Set a filter key on an audit rule. This is deprecated when used with watches. Convert any watches to the syscall form of rules. It is still valid for use with deleting or listing rules.

-p [r|w|x|a]

Describe the permission access type that a file system watch will trigger on. This is deprecated. Convert watches to the syscall form.

-S [Syscall name or number|all]

Any syscall name or number may be used. The word 'all' may also be used. If the given syscall is made by a program, then start an audit record. If a field rule is given and no syscall is specified, it will default to all syscalls. You may also specify multiple syscalls in the same rule by using multiple -S options in the same rule. Doing so improves performance since fewer rules need to be evaluated. Alternatively, you may pass a comma separated list of syscall names. If you are on a bi-arch system, like x86_64, you should be aware that auditctl simply takes the text, looks it up for the native arch (in this case b64) and sends that rule to the kernel. If there are no additional arch directives, IT WILL APPLY TO BOTH 32 & 64 BIT SYSCALLS. This can have undesirable effects since there is no guarantee that any syscall has the same number on both 32 and 64 bit interfaces. You will likely want to control this and write 2 rules, one with arch equal to b32 and one with b64 to make sure the kernel finds the events that you intend. See the arch field discussion for more info.

-w path

Place a watch on path. If the path is a file, it's almost the same as using the -F path option on a syscall rule. If the watch is on a directory, it's almost the same as using the -F dir option on a syscall rule. The -w form of writing watches is for backwards compatibility and is deprecated due to poor system performance. Convert watches of this form to the syscall based form. The only valid options when using a watch are the -p and -k.

-W path

Remove a watch for the file system object at path. The rule must match exactly. See -d discussion for more info.

## PERFORMANCE TIPS
Syscall rules get evaluated for each syscall for every program. If you have 10 syscall rules, every program on your system will delay during a syscall while the audit system evaluates each rule. Too many syscall rules will hurt performance. Try to combine as many as you can whenever the filter, action, key, and fields are identical. For example:

```
auditctl -a always,exit -F arch=b64 -S openat -F success=0
```

```
auditctl -a always,exit -F arch=b64 -S truncate -F success=0
```

could be re-written as one rule:

```
auditctl -a always,exit -F arch=b64 -S openat -S truncate -F success=0
```

Also, try to use file system auditing wherever practical. This improves performance. For example, if you were wanting to capture all failed opens & truncates like above, but were only concerned about files in /etc and didn't care about /usr or /sbin, its possible to use this rule:

```
auditctl -a always,exit -F arch=b64 -S openat,truncate -F dir=/etc -F success=0
```

This will be higher performance since the kernel will not evaluate it each and every syscall. It will be handled by the filesystem auditing code and only checked on filesystem related syscalls.

## EXAMPLES
To see all syscalls made by a specific program:

```
# By pid:
auditctl -a always,exit -S all -F pid=1005
# By executable path
auditctl -a always,exit -S all -F exe=/usr/bin/ls
```

To see files opened by a specific user:

```
auditctl -a always,exit -S openat -F auid=510
```

To see unsuccessful openat calls:

```
auditctl -a always,exit -S openat -F success=0
```

To watch a file for changes (2 ways to express):

```
auditctl -w /etc/shadow -p wa # Note this slows the system
auditctl -a always,exit -F arch=b64 -F path=/etc/shadow -F perm=wa
```

To recursively watch a directory for changes (2 ways to express):

```
auditctl -w /etc/ -p wa # Note this slows the system
auditctl -a always,exit -F arch=b64 -F dir=/etc/ -F perm=wa
```

To see if an admin is accessing other user's files:

```
auditctl -a always,exit -F dir=/home/ -F uid=0 -C auid!=obj_uid
```

This is an example rules file:

```
# Remove all existing rules
-D
# Never record sudo invocations
-A exclude,always -F exe=/usr/bin/sudo
```

## DISABLED BY DEFAULT
On many systems auditd is configured to install an -a never,task rule by default. This rule causes every new process to skip all audit rule processing. This is usually done to avoid a small performance overhead imposed by syscall auditing. If you want to use auditd, you need to remove that rule by deleting 10-no-audit.rules and adding 10-base-config.rules to the audit rules directory.

If you have defined audit rules that are not matching when they should, check auditctl -l to make sure there is no never,task rule there.

## FILES
/etc/audit/audit.rules /etc/audit/audit-stop.rules

## SEE ALSO
audit.rules(7), ausearch(8), aureport(8), auditd(8).

## AUTHOR
Steve Grubb


auditd

package: audit

title: auditd(8)

summary: The Linux Audit daemon

text:
# auditd(8)

## NAME
auditd - The Linux Audit daemon

## SYNOPSIS
auditd [-f] [-l] [-n] [-s disable|enable|nochange] [-c <config_dir>]

## DESCRIPTION
auditd is the userspace component to the Linux Auditing System. It's responsible for writing audit records to the disk. Viewing the logs is done with the ausearch or aureport utilities. Configuring the audit system or loading rules is done with the auditctl utility. During startup, the rules in /etc/audit/audit.rules are read by auditctl and loaded into the kernel. Alternately, there is also an augenrules program that reads rules located in /etc/audit/rules.d/ and compiles them into an audit.rules file. The audit daemon itself has some configuration options that the admin may wish to customize. They are found in the auditd.conf file.

## OPTIONS
-f

leave the audit daemon in the foreground for debugging. Messages also go to stderr rather than the audit log.

-l

allow the audit daemon to follow symlinks for config files.

-n

no fork. This is useful for running off of inittab or systemd.

-s=ENABLE_STATE

specify when starting if auditd should change the current value for the kernel enabled flag. Valid values for ENABLE_STATE are "disable", "enable" or "nochange". The default is to enable (and disable when auditd terminates). The value of the enabled flag may be changed during the lifetime of auditd using 'auditctl -e'.

-c

Specify alternate config file directory. Note that this same directory will be passed to the dispatcher. (default: /etc/audit/)

## SIGNALS
SIGHUP

causes auditd to reconfigure. This means that auditd re-reads the configuration file. If there are no syntax errors, it will proceed to implement the requested changes. If the reconfigure is successful, a DAEMON_CONFIG event is recorded in the logs. If not successful, error handling is controlled by space_left_action, admin_space_left_action, disk_full_action, and disk_error_action parameters in auditd.conf.

SIGTERM

caused auditd to discontinue processing audit events, write a shutdown audit event, and exit.

SIGUSR1

causes auditd to immediately rotate the logs. It will consult the max_log_file_action to see if it should keep the logs or not.

SIGUSR2

causes auditd to attempt to resume logging and passing events to plugins. This is usually needed after logging has been suspended or the internal queue is overflowed. Either of these conditions depends on the applicable configuration settings.

SIGCONT

causes auditd to dump a report of internal state to /run/audit/auditd.state.

## EXIT CODES
1

Cannot adjust priority, daemonize, open audit netlink, write the pid file, start up plugins, resolve the machine name, set audit pid, or other initialization tasks.

2

Invalid or excessive command line arguments

4

The audit daemon doesn't have sufficient privilege

6

There is an error in the configuration file

## FILES
/etc/audit/auditd.conf - configuration file for audit daemon

/etc/audit/audit.rules - audit rules to be loaded at startup

/etc/audit/rules.d/ - directory holding individual sets of rules to be compiled into one file by augenrules.

/etc/audit/plugins.d/ - directory holding individual plugin configuration files.

/etc/audit/audit-stop.rules - These rules are loaded when the audit daemon stops.

/run/audit/auditd.state - report about internal state.

## NOTES
A boot param of audit=1 should be added to ensure that all processes that run before the audit daemon starts is marked as auditable by the kernel. Not doing that will make a few processes impossible to properly audit.

The audit daemon can receive audit events from other audit daemons via the audisp-remote plugin. The audit daemon may be linked with tcp_wrappers to control which machines can connect. If this is the case, you can add an entry to hosts.allow and deny.

## SEE ALSO
auditd.conf(5), auditd-plugins(5), ausearch(8), aureport(8), auditctl(8), augenrules(8), audit.rules(7).

## AUTHOR
Steve Grubb


augenrules

title: augenrules(8)

text:
# augenrules(8)

## NAME
augenrules - a script that merges component audit rule files

## SYNOPSIS
augenrules [--check] [--load]

## DESCRIPTION
augenrules is a script that merges all component audit rules files, found in the audit rules directory, /etc/audit/rules.d, placing the merged file in /etc/audit/audit.rules. Component audit rule files, must end in .rules in order to be processed. All other files in /etc/audit/rules.d are ignored.

The files are concatenated in order, based on their natural sort (see -v option of ls(1)) and stripped of empty and comment (#) lines.

The last processed -D directive without an option, if present, is always emitted as the first line in the resultant file. Those with an option are replicated in place. The last processed -b directive, if present, is always emitted as the second line in the resultant file. The last processed -f directive, if present, is always emitted as the third line in the resultant file. The last processed -e directive, if present, is always emitted as the last line in the resultant file.

The generated file is only copied to /etc/audit/audit.rules, if it differs.

## OPTIONS
--check

test if rules have changed and need updating without overwriting audit.rules.

--load

load old or newly built rules into the kernel.

## FILES
/etc/audit/rules.d/ /etc/audit/audit.rules

## SEE ALSO
audit.rules(7), auditctl(8), auditd(8).


aulast

title: aulast(8)

summary: a program similar to last

text:
# aulast(8)

## NAME
aulast - a program similar to last

## SYNOPSIS
aulast [ options ]

## DESCRIPTION
aulast is a program that prints out a listing of the last logged in users similarly to the program last and lastb. Aulast searches back through the audit logs or the given audit log file and displays a list of all users logged in (and out) based on the range of time in the audit logs. Names of users and tty’s can be given, in which case aulast will show only those entries matching the arguments.

The pseudo user reboot logs in each time the system is rebooted. Thus last reboot will show a log of all reboots since the log file was created.

The main difference that a user will notice is that aulast print events from oldest to newest, while last prints records from newest to oldest. Also, the audit system is not notified each time a tty or pty is allocated, so you may not see quite as many records indicating users and their tty's.

## OPTIONS
--bad

Report on the bad logins.

--debug

Print debug messages to stderr.

--extract

Write raw audit records used to create the displayed report into a file aulast.log in the current working directory.

-f file

Use the file instead of the audit logs for input.

--proof

Print out the audit event serial numbers used to determine the preceding line of the report. A Serial number of 0 is a place holder and not an actual event serial number. The serial numbers can be used to examine the actual audit records in more detail. Also an ausearch query is printed that will let you find the audit records associated with that session.

--stdin

Take audit records from stdin. The audit events must be in the raw format.

--tty tty

Limit the report to a specific tty's activity. The names of ttys can be abbreviated. For example, 0 is the same as tty0.

--user name

Limit the report to a specific user.

## EXAMPLES

```
To see this month's logins
ausearch --start this-month --raw | aulast --stdin
```

## SEE ALSO
last(1), lastb(1), ausearch(8), aureport(8).

## AUTHOR
Steve Grubb


aulastlog

title: aulastlog(8)

summary: a program similar to lastlog

text:
# aulastlog(8)

## NAME
aulastlog - a program similar to lastlog

## SYNOPSIS
aulastlog [ options ]

## DESCRIPTION
aulastlog is a program that prints out the last login for all users of the local machine similar to the way lastlog does. The login-name, port, and last login time will be printed.

If the user has never logged in, the message ** Never logged in** will be displayed instead of the port and time.

## OPTIONS
-u, --user

Print the lastlog record for user with specified LOGIN only.

--stdin

Use stdin as the source of audit records. The audit events must be in the raw format.

## SEE ALSO
lastlog(8), ausearch(8), aureport(8).

## AUTHOR
Steve Grubb


aureport

title: aureport(8)

text:
# aureport(8)

## NAME
aureport - a tool that produces summary reports of audit daemon logs

## SYNOPSIS
aureport [options]

## DESCRIPTION
aureport is a tool that produces summary reports of the audit system logs. The aureport utility can also take input from stdin as long as the input is the raw log data. The reports have a column label at the top to help with interpretation of the various fields. Except for the main summary report, all reports have the audit event number. You can subsequently lookup the full event with ausearch -a event number. You may need to specify start & stop times if you get multiple hits. The reports produced by aureport can be used as building blocks for more complicated analysis.

## OPTIONS
-au, --auth

Report about authentication attempts

-a, --avc

Report about avc messages

--comm

Report about commands run

-c, --config

Report about config changes

-cr, --crypto

Report about crypto events

--debug

Write malformed events that are skipped to stderr.

--eoe-timeout seconds

Set the end of event parsing timeout. See end_of_event_timeout in auditd.conf(5) for details. Note that setting this value will override any configured value found in /etc/auditd/auditd.conf.

-e, --event

Report about events

--escape option

This option determines if the output is escaped to make the content safer for certain uses. The options are raw , tty , shell , and shell_quote. Each mode includes the characters of the preceding mode and escapes more characters. That is to say shell includes all characters escaped by tty and adds more. tty is the default.

-f, --file

Report about files and af_unix sockets

--failed

Only select failed events for processing in the reports. The default is both success and failed events.

-h, --host

Report about hosts

--help

Print brief command summary

-i, --interpret

Interpret numeric entities into text. For example, uid is converted to account name. The conversion is done using the current resources of the machine where the search is being run. If you have renamed the accounts, or don't have the same accounts on your machine, you could get misleading results.

-if, --input file | directory

Use the given file or directory instead of the logs. This is to aid analysis where the logs have been moved to another machine or only part of a log was saved. The path length is limited to 4064 bytes.

--input-logs

Use the log file location from auditd.conf as input for analysis. This is needed if you are using aureport from a cron job.

--integrity

Report about integrity events

-k, --key

Report about audit rule keys

-l, --login

Report about logins

-m, --mods

Report about account modifications

-ma, --mac

Report about Mandatory Access Control (MAC) events

-n, --anomaly

Report about anomaly events. These events include NIC going into promiscuous mode and programs segfaulting.

--node node-name

Only select events originating from node name string for processing in the reports. The default is to include all nodes. Multiple nodes are allowed.

-nc, --no-config

Do not include the CONFIG_CHANGE event. This is particularly useful for the key report because audit rules have key labels in many cases. Using this option gets rid of these false positives.

-p, --pid

Report about processes

-r, --response

Report about responses to anomaly events

-s, --syscall

Report about syscalls

--success

Only select successful events for processing in the reports. The default is both success and failed events.

--summary

Run the summary report that gives a total of the elements of the main report. Not all reports have a summary.

-t, --log

This option will output a report of the start and end times for each log.

--tty

Report about tty keystrokes

-te, --end [end-date] [end-time]

Search for events with time stamps equal to or before the given end time. The format of end time depends on your locale. If the date is omitted, today is assumed. If the time is omitted, now is assumed. Use 24 hour clock time rather than AM or PM to specify time. An example date using the en_US.utf8 locale is 09/03/2009. An example of time is 18:00:00. The date format accepted is influenced by the LC_TIME environmental variable. You may also use the word: now, recent, this-hour, boot, today, yesterday, this-week, week-ago, this-month, this-year. Now means starting now. Recent is 10 minutes ago. Boot means the time of day to the second when the system last booted. Today means now. Yesterday is 1 second after midnight the previous day. This-week means starting 1 second after midnight on day 0 of the week determined by your locale (see localtime). Week-ago means 1 second after midnight exactly 7 days ago. This-month means 1 second after midnight on day 1 of the month. This-year means the 1 second after midnight on the first day of the first month.

-tm, --terminal

Report about terminals

-ts, --start [start-date] [start-time]

Search for events with time stamps equal to or after the given end time. The format of end time depends on your locale. If the date is omitted, today is assumed. If the time is omitted, midnight is assumed. Use 24 hour clock time rather than AM or PM to specify time. An example date using the en_US.utf8 locale is 09/03/2009. An example of time is 18:00:00. The date format accepted is influenced by the LC_TIME environmental variable. You may also use the word: now, recent, this-hour, boot, today, yesterday, this-week, week-ago, this-month, this-year. Boot means the time of day to the second when the system last booted. Today means starting at 1 second after midnight. Recent is 10 minutes ago. Yesterday is 1 second after midnight the previous day. This-week means starting 1 second after midnight on day 0 of the week determined by your locale (see localtime). Week-ago means starting 1 second after midnight exactly 7 days ago. This-month means 1 second after midnight on day 1 of the month. This-year means the 1 second after midnight on the first day of the first month.

-u, --user

Report about users

-v, --version

Print the version and exit

--virt

Report about Virtualization events

-x, --executable

Report about executables

## NOTE
The boot time option is a convenience function and has limitations. The time it calculates is based on time now minus /proc/uptime. If after boot the system clock has been adjusted, perhaps by ntp, then the calculation may be wrong. In that case you'll need to fully specify the time. You can check the time it would use by running:

date -d "`cut -f1 -d. /proc/uptime` seconds ago"

## SEE ALSO
ausearch(8), auditd(8), auditd.conf(5).


ausearch

title: ausearch(8)

summary: a tool to query audit daemon logs

text:
# ausearch(8)

## NAME
ausearch - a tool to query audit daemon logs

## SYNOPSIS
ausearch [options]

## DESCRIPTION
ausearch is a tool that can query the audit daemon logs based for events based on different search criteria. The ausearch utility can also take input from stdin as long as the input is the raw log data. Each commandline option given forms an "and" statement. For example, searching with -m and -ui means return events that have both the requested type and match the user id given. An exception is the -m and -n options; multiple record types and nodes are allowed in a search which will return any matching node and record.

It should also be noted that each syscall excursion from user space into the kernel and back into user space has one event ID that is unique. Any auditable event that is triggered during this trip share this ID so that they may be correlated.

Different parts of the kernel may add supplemental records. For example, an audit event on the syscall "open" will also cause the kernel to emit a PATH record with the file name. The ausearch utility will present all records that make up one event together. This could mean that even though you search for a specific kind of record, the resulting events may contain SYSCALL records.

Also be aware that not all record types have the requested information. For example, a PATH record does not have a hostname or a loginuid.

## OPTIONS
-a, --event audit-event-id

Search for an event based on the given event ID. Messages always start with something like msg=audit(1116360555.329:2401771). The event ID is the number after the ':'. All audit events that are recorded from one application's syscall have the same audit event ID. A second syscall made by the same application will have a different event ID. This way they are unique.

--arch CPU

Search for events based on a specific CPU architecture. If you do not know the arch of your machine but you want to use the 32 bit syscall table and your machine supports 32 bits, you can also use b32 for the arch. The same applies to the 64 bit syscall table, you can use b64. The arch of your machine can be found by doing 'uname -m'.

-c, --comm comm-name

Search for an event based on the given comm name. The comm name is the executable's name from the task structure.

--debug

Write malformed events that are skipped to stderr.

--checkpoint checkpoint-file

Checkpoint the output between successive invocations of ausearch such that only events not previously output will print in subsequent invocations. An auditd event is made up of one or more records. When processing events, ausearch defines events as either complete or in-complete. A complete event is either a single record event or one whose event time occurred 2 seconds in the past compared to the event being currently processed.

A checkpoint is achieved by recording the last completed event output along with the device number and inode of the file the last completed event appeared in checkpoint-file. On a subsequent invocation, ausearch will load this checkpoint data and as it processes the log files, it will discard all complete events until it matches the checkpointed one. At this point, it will start outputting complete events.

Should the file or the last checkpointed event not be found, one of a number of errors will result and ausearch will terminate. See EXIT STATUS for detail.

--eoe-timeout seconds

Set the end of event parsing timeout. See end_of_event_timeout in auditd.conf(5) for details. Note that setting this value will override any configured value found in /etc/auditd/auditd.conf.

-e, --exit exit-code-or-errno

Search for an event based on the given syscall exit code or errno.

--escape option

This option determines if the output is escaped to make the content safer for certain uses. The options are raw , tty , shell , and shell_quote. Each mode includes the characters of the preceding mode and escapes more characters. That is to say shell includes all characters escaped by tty and adds more. tty is the default.

--extra-keys

When the format mode is csv, this option will add a final column with key information if its exists for the event. This would only occur on SYSCALL records which were the result of triggering an audit rule that defines a key.

--extra-labels

When the format mode is csv, this option will add columns of information about subject and object labels when they exist.

--extra-obj2

When the format mode is csv, this option will add columns of information about a second object when it exists. It's rare that a second object is part of a record. Some examples are when a file is renamed from one name to another or when a device is mounted to a path.

--extra-time

When the format mode is csv, this option will add columns of information about broken down time to make subsetting easier.

-f, --file file-name

Search for an event based on the given filename. The argument will match normal files as well as af_unix sockets.

--format option

Events that match the search criteria are formatted using this option. The supported formats are: raw, default, interpret, csv, and text. The raw option is described under the --raw command line option. The default option is what you get when no formatting options are passed. It includes one line as a visual separator which indicates the time stamp and then the records of the event follow. The interpret option is explained under the -i command line option. The csv option outputs the results of the search as a normalized event in comma separated value (CSV) format suitable for import into analytical programs. The text option turns the event into an English sentence that is easier to understand than other options, but it comes at the expense of loss of detail. In most cases this is perfectly fine since the original event still retains all the original information.

-ga, --gid-all all-group-id

Search for an event with either effective group ID or group ID matching the given group ID.

-ge, --gid-effective effective-group-id

Search for an event with the given effective group ID or group name.

-gi, --gid group-id

Search for an event with the given group ID or group name.

-h, --help

Help

-hn, --host host-name

Search for an event with the given host name. The hostname can be either a hostname, fully qualified domain name, or numeric network address. No attempt is made to resolve numeric addresses to domain names or aliases. This search typically correlates to the addr or host field of audit events. Also see the --node command which searches the node field.

-i, --interpret

Interpret numeric entities into text. For example, uid is converted to account name. If the audit logs are unenriched, the conversion is done using the current resources of the machine where the search is being run. If you have renamed the accounts, or don't have the same accounts on your machine, you could get misleading results. If the logs are enriched, it uses the supplemental data to do the conversion. This allows accurate log reporting even when run on a different machine than the original logs came from.

-if, --input file-name | directory

Use the given file or directory instead of the logs. This is to aid analysis where the logs have been moved to another machine or only part of a log was saved. The path length is limited to 4064 bytes.

--input-logs

Use the log file location from auditd.conf as input for searching. This is needed if you are using ausearch from a cron job.

--just-one

Stop after emitting the first event that matches the search criteria.

-k, --key key-string

Search for an event based on the given key string.

-l, --line-buffered

Flush output on every line. Most useful when stdout is connected to a pipe and the default block buffering strategy is undesirable. May impose a performance penalty.

-m, --message message-type | comma-sep-message-type-list

Search for an event matching the given message type. (Message types are also known as record types.) You may also enter a comma separated list of message types or multiple individual message types each with its own -m option. There is an ALL message type that doesn't exist in the actual logs. It allows you to get all messages in the system. The list of valid messages types is long. The program will display the list whenever no message type is passed with this parameter. The message type can be either text or numeric. If you enter a list, there can be only commas and no spaces separating the list.

-n, --node

Search for events originating from a specific machine. Multiple nodes are allowed, and if any nodes match, the event is matched. This search uses the node field in audit events. Also see the --host command which search for events related to host information in the audit trail.

-o, --object SE-Linux-context-string

Search for event with tcontext (object) matching the string.

-p, --pid process-id

Search for an event matching the given process ID.

-pp, --ppid parent-process-id

Search for an event matching the given parent process ID.

-r, --raw

Output is completely unformatted. This is useful for extracting records to a file that can still be interpreted by audit tools or when piping to other audit tools.

-sc, --syscall syscall-name-or-value

Search for an event matching the given syscall. You may either give the numeric syscall value or the syscall name. If you give the syscall name, it will use the syscall table for the machine that you are using.

-se, --context SE-Linux-context-string

Search for events with either scontext/subject or tcontext/object matching the given string.

--session Login-Session-ID

Search for events matching the given Login Session ID. This process attribute is set when a user logs in and can tie any process to a particular user login.

-su, --subject SE-Linux-context-string

Search for event with scontext (subject) matching the string.

-sv, --success success-value

Search for an event matching the given success value. Legal values are yes and no.

-te, --end [end-date] [end-time]

Search for events with time stamps equal to or before the given end time. The format of end time depends on your locale. You can check the format of your locale by running date '+%x'. If the date is omitted, today is assumed. If the time is omitted, now is assumed. Use 24 hour clock time rather than AM or PM to specify time. An example date using the en_US.utf8 locale is 09/03/2009. An example of time is 18:00:00. The date format accepted is influenced by the LC_TIME environmental variable. You may also use the word: now, recent, this-hour, boot, today, yesterday, this-week, week-ago, this-month, or this-year. Now means starting now. Recent is 10 minutes ago. Boot means the time of day to the second when the system last booted. Today means now. Yesterday is 1 second after midnight the previous day. This-week means starting 1 second after midnight on day 0 of the week determined by your locale (see localtime). Week-ago means 1 second after midnight exactly 7 days ago. This-month means 1 second after midnight on day 1 of the month. This-year means the 1 second after midnight on the first day of the first month.

-ts, --start [start-date] [start-time]

Search for events with time stamps equal to or after the given start time. The format of start time depends on your locale. You can check the format of your locale by running date '+%x'. If the date is omitted, today is assumed. If the time is omitted, midnight is assumed. Use 24 hour clock time rather than AM or PM to specify time. An example date using the en_US.utf8 locale is 09/03/2009. An example of time is 18:00:00. The date format accepted is influenced by the LC_TIME environmental variable. You may also use the word: now, recent, this-hour, boot, today, yesterday, this-week, week-ago, this-month, this-year, or checkpoint. Boot means the time of day to the second when the system last booted. Today means starting at 1 second after midnight. Recent is 10 minutes ago. Yesterday is 1 second after midnight the previous day. This-week means starting 1 second after midnight on day 0 of the week determined by your locale (see localtime). Week-ago means starting 1 second after midnight exactly 7 days ago. This-month means 1 second after midnight on day 1 of the month. This-year means the 1 second after midnight on the first day of the first month.

checkpoint means ausearch will use the timestamp found within a valid checkpoint file ignoring the recorded inode, device, serial, node and event type also found within a checkpoint file. Essentially, this is the recovery action should an invocation of ausearch with a checkpoint option fail with an exit status of 10, 11 or 12. It could be used in a shell script something like:

```
ausearch --checkpoint /etc/audit/auditd_checkpoint.txt -i
_au_status=$?
if test ${_au_status} eq 10 -o ${_au_status} eq 11 -o ${_au_status} eq 12
then

  ausearch --checkpoint /etc/audit/auditd_checkpoint.txt --start checkpoint -i
fi
```

-tm, --terminal terminal

Search for an event matching the given terminal value. Some daemons such as cron and atd use the daemon name for the terminal.

-ua, --uid-all all-user-id

Search for an event with either user ID, effective user ID, or login user ID (auid) matching the given user ID.

-ue, --uid-effective effective-user-id

Search for an event with the given effective user ID.

-ui, --uid user-id

Search for an event with the given user ID.

-ul, --loginuid login-id

Search for an event with the given login user ID. All entry point programs that are PAMified need to be configured with pam_loginuid required for the session for searching on loginuid (auid) to be accurate.

-uu, --uuid guest-uuid

Search for an event with the given guest UUID.

-v, --version

Print the version and exit

-vm, --vm-name guest-name

Search for an event with the given guest name.

-w, --word

String based matches must match the whole word. This category of matches include: filename, hostname, terminal, keys, and SE Linux context.

-x, --executable executable

Search for an event matching the given executable name.

## EXIT STATUS
0

if OK,

1

if nothing found, or argument errors or minor file access/read errors,

10

invalid checkpoint data found in checkpoint file,

11

checkpoint processing error

12

checkpoint event not found in matching log file

## NOTE
The boot time option is a convenience function and has limitations. The time it calculates is based on time now minus /proc/uptime. If after boot the system clock has been adjusted, perhaps by ntp, then the calculation may be wrong. In that case you'll need to fully specify the time. You can check the time it would use by running:

date -d "`cut -f1 -d. /proc/uptime` seconds ago"

## EXAMPLES

```
Search for a specific user:
# ausearch --start today --loginuid john -i
Check the SELinux log for any denials today
# ausearch --start today -m avc -i
Output any recent SELinux log
# ausearch -m avc,user_avc,selinux_err,user_selinux_err -i -ts recent
Output logs in text format
# ausearch --start today --format text
Output TTY events interpreted and shell escaped
# ausearch --start today -m TTY -i --escape shell_quote
```

## SEE ALSO
auditd(8), auditd.conf(5), aureport(8), pam_loginuid(8).


ausyscall

title: ausyscall(8)

text:
# ausyscall(8)

## NAME
ausyscall - a program that allows mapping syscall names and numbers

## SYNOPSIS
ausyscall [arch] name | number | --dump | --exact

## DESCRIPTION
ausyscall is a program that prints out the mapping from syscall name to number and reverse for the given arch. The arch can be anything returned by `uname -m`. If arch is not given, the program will take a guess based on the running image. Or for convenience, you can pass b32 or b64 to use the current arch but a specific ABI. You may give the syscall name or number and it will find the opposite. You can also dump the whole table with the --dump option. By default a syscall name lookup will be a substring match meaning that it will try to match all occurrences of the given name with syscalls. So giving a name of chown will match both fchown and chown as any other syscall with chown in its name. If this behavior is not desired, pass the --exact flag and it will do an exact string match.

The program takes the special arch, uring, to denote that you want to specify io_uring operations. In this case, the arch must be given because it will otherwise detect the underlying hardware.

This program can be used to verify syscall numbers on a biarch platform for rule optimization. For example, suppose you had an auditctl rule:

-a always, exit -S open -F exit=-EPERM -k fail-open

If you wanted to verify that both 32 and 64 bit programs would be audited, run "ausyscall i386 open" and then "ausyscall x86_64 open". (Or use the b32 and b64 option.) Look at the returned numbers. If they are different, you will have to write two auditctl rules to get complete coverage.

```
-a always,exit -F arch=b32 -S open -F exit=-EPERM -k fail-open
-a always,exit -F arch=b64 -S open -F exit=-EPERM -k fail-open
```

For more information about a specific syscall, use the man program and pass the number 2 as an argument to make sure that you get the syscall information rather than a shell script program or glibc function call of the same name. For example, if you wanted to learn about the open syscall, type: man 2 open.

## OPTIONS
--dump

Print all syscalls for the given arch

--exact

Instead of doing a partial word match, match the given syscall name exactly.

## SEE ALSO
ausearch(8), auditctl(8).

## AUTHOR
Steve Grubb


autofs

package: autofs

title: autofs(8)

summary: Service control for the automounter

text:
# autofs(8)

## NAME
autofs - Service control for the automounter

## SYNOPSIS
If a SysV init script system is being used:

/etc/init.d/autofs start|stop|restart|reload|status

or if the systemd init system is being used:

systemctl start|stop|restart|reload|status autofs.service

## DESCRIPTION
autofs controls the operation of the automount(8) daemon(s) running on the Linux system. Usually autofs is invoked at system boot time with the start parameter and at shutdown time with the stop parameter. Service control actions can also be manually invoked by the system administrator to shut down, restart, reload or obtain service status.

## OPERATION
autofs will consult a configuration file /etc/auto.master (see auto.master(5)) by default to find mount points on the system. For each of those mount points automount(8) will mount and start a thread, with the appropriate parameters, to manage the mount point.

/etc/init.d/autofs reload or systemctl autofs.service reload will check the current auto.master map against the current automount managed mounts. It will terminate those daemons or threads (depending on autofs version) whose entries have been removed, re-read the automount maps for entries that have changed and start new daemons or threads for entries that have been added.

If an indirect map is modified then the change will become effective immediately. If an indirect map uses the browse option, the master map contains direct mount maps or the auto.master map is modified then the autofs service control reload action must be rerun to activate the changes.

However, if a map entry has offsets and is currently in use the offset mounts cannot be updated due to potential mount dependencies. In this case the map entry offsets will not be updated until after the map entry has expired.

/etc/init.d/autofs status or systemctl status autofs.service will display the status of, automount(8), running or not. When using the systemd init system the status output includes somewhat more information related to the service status.

systemctl(1) has more functions than the actions mentioned here, see systemctl(1) for more information.

## SEE ALSO
automount(8), autofs(5), autofs.conf(5), auto.master(5), autofs_ldap_auth.conf(5), systemctl(1).

## AUTHOR
This manual page was written by Christoph Lameter <chris@waterf.org>, for the Debian GNU/Linux system. Edited by H. Peter Anvin <hpa@transmeta.com> and Ian Kent <raven@themaw.net>.


automount

title: automount(8)

summary: manage autofs mount points

text:
# automount(8)

## NAME
automount - manage autofs mount points

## SYNOPSIS
automount [options] [master_map]

## DESCRIPTION
The automount program is used to manage mount points for autofs, the inlined Linux automounter. automount works by reading the auto.master(5) map and sets up mount points for each entry in the master map allowing them to be automatically mounted when accessed. The file systems are then automatically umounted after a period of inactivity.

## OPTIONS
-h, --help

Print brief help on program usage.

-p, --pid-file

Write the pid of the daemon to the specified file.

-t <seconds>, --timeout <seconds>

Set the global minimum timeout, in seconds, until directories are unmounted. The default is 10 minutes. Setting the timeout to zero disables umounts completely. The internal program default is 10 minutes, but the default installed configuration overrides this and sets the timeout to 5 minutes to be consistent with earlier autofs releases.

-M <seconds>, --master-wait <seconds>

Set the maximum time to wait for the master map to become available if it cannot be read at program start.

-n <seconds>, --negative-timeout <seconds>

Set the default timeout for caching failed key lookups. The default is 60 seconds.

-v, --verbose

Enables logging of general status and progress messages for all autofs managed mounts.

-d[LEVEL], --debug[=LEVEL]

Enables logging of general status and progress messages as well as debugging messages for all autofs managed mounts. The default LEVEL is 0. automounter must perform OpenLDAP authenticated binds for optional argument LEVEL to have any effect. OpenLDAP uses a bitmap to enable debugging for specific components. Debug LEVEL=0 disables libldap deugging. For further details see slapd(8).

-Dvariable=value, --define variable=value

Define a global macro substitution variable. Global definitions are over-ridden macro definitions of the same name specified in mount entries.

-S, --systemd-service

Used when running the automounter as a systemd service to ensure log entry format is consistent with the log entry format when running as a daemon.

-f, --foreground

Run the daemon in the foreground and log to stderr instead of syslog."

-r, --random-multimount-selection

Enables the use of random selection when choosing a host from a list of replicated servers.

-m, --dumpmaps [<map type> <map name>]

With no parameters, list information about the configured automounter maps, then exit. If the dumpmaps option is given and is followed by two parameters, "<map type> <map name>" then simple "<key, value>" pairs that would be read in by a map read are printed to stdout if the given map type and map name are found in the map configuration.

If the map is an LDAP map and there is more than one map of same name in different base dns only the first map encountered by autofs will be listed. Similarly, if the map is a file map and there is more than one map of the same name in different directories, only the first map encountered will be listed.

If the map type is an old style multi-map and any one of the map names in the multi-map entry matches the given map name the entries that would be used by autofs for the whole multi-map will be listed.

-O, --global-options

Allows the specification of global mount options used for all master map entries. These options will either replace or be appended to options given in a master map entry depending on the APPEND_OPTIONS configuration setting.

-V, --version

Display the version number, then exit.

-l, --set-log-priority priority path [path,...]

Set the daemon log priority to the specified value. Valid values include the numbers 0-7, or the strings emerg, alert, crit, err, warning, notice, info, or debug. Log level debug will log everything, log levels info, warn (or warning), or notice with enable the daemon verbose logging. Any other level will set basic logging. Note that enabling debug or verbose logging in the autofs global configuration will override dynamic log level changes. For example, if verbose logging is set in the configuration then attempting to set logging to basic logging, by using alert, crit, err or emerg won't stop the verbose logging. However, setting logging to debug will lead to everything (debug logging) being logged witch can then also be disabled, returning the daemon to verbose logging. This option can be specified to change the logging priority of an already running automount process. The path argument corresponds to the automounted path name as specified in the master map.

-C, --dont-check-daemon

Don't check if the daemon is currently running (see NOTES).

-F, --force

Force an unlink umount of existing mounts under configured autofs managed mount points during startup. This can cause problems for processes with working directories within these mounts (see NOTES).

-U, --force-exit

Force an unlink umount of existing mounts under configured autofs managed mount points and exit rather than continuing the startup. This can cause problems for processes with working directories within these mounts (see NOTES).

## ARGUMENTS
automount takes one optional argument, the name of the master map to use.

master_map

Location for autofs master map that defines autofs managed mount points and the mount maps they will use. The default is auto.master.

## NOTES
If the automount daemon catches a USR1 signal, it will umount all currently unused autofs managed mounted file systems and continue running (forced expire). If it catches the TERM signal it will umount all unused autofs managed mounted file systems and exit if there are no remaining busy file systems. If autofs has been compiled with the option to ignore busy mounts on exit it will exit leaving any busy mounts in place otherwise busy file systems will not be umounted and autofs will not exit. Alternatively, if autofs has been compiled with the option to enable forced shutdown then a USR2 signal to the daemon will cause all mounts to be umounted and any busy mounts to be forcibly umounted, including autofs mount point directories (summary execution). Note that the forced umount is an unlink operation and the actual umount will not happen in the kernel until active file handles are released. The daemon also responds to a HUP signal which triggers an update of the maps for each mount point.

If any autofs mount point directories are busy when the daemon is sent an exit signal the daemon will not exit. The exception to this is if autofs has been built with configure options to either ignore busy mounts at exit or force umount at exit. If the ignore busy mounts at exit option is used the filesystems will be left in a catatonic (non-functional) state and can be manually umounted when they become unused. If the force umount at exit option is used the filesystems will be umounted but the mount will not be released by the kernel until they are no longer in use by the processes that held them busy. If automount managed filesystems are found mounted when autofs is started they will be recovered unless they are no longer present in the map in which case they need to umounted manually.

If the option to disable the check to see if the daemon is already running is used be aware that autofs currently may not function correctly for certain types of automount maps. The mounts of the separate daemons might interfere with one another. The implications of running multiple daemon instances needs to be checked and tested before we can say this is supported.

If the option to force an unlink of mounts at startup is used then processes whose working directory is within unlinked automounted directories will not get the correct pwd from the system. This is because, after the mount is unlinked from the mount tree, anything that needs to walk back up the mount tree to construct a path, such as getcwd(2) and the proc filesystem /proc/<pid>/cwd, cannot work because the point from which the path is constructed has been detached from the mount tree.

## SEE ALSO
autofs(5), autofs(8), autofs.conf(5), auto.master(5), mount(8), autofs_ldap_auth.conf(5).

## BUGS
Don't know, I've fixed everything I know about.

The documentation could be better.

Please report other bugs along with a detailed description to <autofs@vger.kernel.org>. Visit http://vger.kernel.org/vger-lists.html#autofs for information about the list.

## AUTHOR
H. Peter Anvin <hpa@transmeta.com> and Ian Kent <raven@themaw.net>.


avahi-autoipd

package: avahi-autoipd

title: avahi-autoipd(8)

text:
# avahi-autoipd(8)

## NAME
avahi-autoipd - IPv4LL network address configuration daemon

## SYNOPSIS
avahi-autoipd [options] interface

avahi-autoipd --kill interface

avahi-autoipd --refresh interface

avahi-autoipd --check interface

## DESCRIPTION
avahi-autoipd implements IPv4LL, "Dynamic Configuration of IPv4 Link-Local Addresses" (IETF RFC3927), a protocol for automatic IP address configuration from the link-local 169.254.0.0/16 range without the need for a central server. It is primarily intended to be used in ad-hoc networks which lack a DHCP server.

IPv4LL is part of the Zeroconf stack.

avahi-autoipd can be used as stand-alone address allocator or as plugin for a DHCP client such as ISC's dhclient, where it can be used as fallback solution if no DHCP server is found.

To allow communication between hosts that have only an IPv4LL address assigned and hosts that only have a routable IP address assigned you may add the following routes to both network configurations:

route add -net 169.254.0.0 netmask 255.255.0.0 dev eth0 metric 99

route add default dev eth0 metric 99

See http://developer.apple.com/qa/qa2004/qa1357.html for more information.

## OPTIONS
-D | --daemonize

Daemonize after startup. Implies --syslog.

-k | --kill

Kill an already running avahi-autoipd on the specified network interface. (Equivalent to sending a SIGTERM)

-r | --refresh

Tell an already running avahi-autoipd to re-announce the acquired IP address on the specified network interface. (Equivalent to sending a SIGHUP)

-c | --check

Return 0 as return code if avahi-autoipd is already running for the specified network interface.

-s | --syslog

Log to syslog instead of STDERR. Implied by --daemonize.

--debug

Enable verbose mode.

--no-drop-root

Don't drop root privileges after startup. We recommend not to use this option.

--no-chroot

Don't chroot(2) the daemon. This option is only available when compiled with chroot() support.

-S | --start=

Try to acquire the specified IP address, which must be from the IPv4LL range 169.254.0.0/16.

-w | --wait

Wait until a IP address has been successfully acquired before detaching. Only valid in combination with --daemonize.

--force-bind

Acquire an IPv4LL address, even if a routable address has been configured on the interface.

--no-proc-title

Don't change the process name while running. Unless this option is specified avahi-autoipd will reflect its current state and the IP address in the process title.

-h | --help

Show help.

-v | --version

Show version information.

## FILES
/etc/avahi/avahi-autoipd.action: the script to run when an IP address as been acquired or is lost.

## SIGNALS
SIGINT, SIGTERM: avahi-autoipd will shutdown. (Same as --kill)

SIGHUP: avahi-autoipd will re-announce the acquired IP address. (Same as --refresh)

## AUTHORS
The Avahi Developers <avahi (at) lists (dot) freedesktop (dot) org>; Avahi is available from http://avahi.org/

## SEE ALSO
avahi-autoipd.action(8), dhclient(8)

http://avahi.org/wiki/AvahiAutoipd documents how avahi-autoipd is best packaged and integrated into distributions.

## COMMENTS
This man page was written using xml2man(1) by Oliver Kurth.


avahi-autoipd.action

title: avahi-autoipd.action(8)

summary: avahi-autoipd action script

text:
# avahi-autoipd.action(8)

## NAME
avahi-autoipd.action - avahi-autoipd action script

## SYNOPSIS
/etc/avahi/avahi-autoipd.action

## DESCRIPTION
avahi-autoipd.action is the action script that is called whenever an IP address has been acquired by avahi-autoipd or when it detected an IP address conflict. The script should add or remove the specified address from the specified network interface.

## PARAMETERS
argv[1] An event string: one of BIND, CONFLICT, UNBIND or STOP. If BIND is passed an IP address has been successfully acquired and the script shall add it to the network interface. If CONFLICT is passed avahi-autopid detected a IP address on the local network, the action script should remove the configured IP address. If UNBIND is passed the IP address should be removed from the interface, too, because a routable address has been configured to the interface by some other program. If STOP is passed the avahi-autoipd is being shutdown and the action script should remove the IP address. In short: on BIND the address should be added to the interface, on CONFLICT, UNBIND or STOP it should be removed.

argv[2] The network interface name.

argv[3] An IP address from the IPv4LL range.

## AUTHORS
The Avahi Developers <avahi (at) lists (dot) freedesktop (dot) org>; Avahi is available from http://avahi.org/

## SEE ALSO
avahi-autoipd(8), dhclient-script(8), ip(8), ifconfig(8)

## COMMENTS
This man page was written using xml2man(1) by Oliver Kurth.


avahi-daemon

package: avahi-daemon

title: avahi-daemon(8)

summary: The Avahi mDNS/DNS-SD daemon

text:
# avahi-daemon(8)

## NAME
avahi-daemon - The Avahi mDNS/DNS-SD daemon

## SYNOPSIS
avahi-daemon [options]

avahi-daemon --kill

avahi-daemon --reload

avahi-daemon --check

## DESCRIPTION
The Avahi mDNS/DNS-SD daemon implements Apple's Zeroconf architecture (also known as "Rendezvous" or "Bonjour"). The daemon registers local IP addresses and static services using mDNS/DNS-SD and provides two IPC APIs for local programs to make use of the mDNS record cache the avahi-daemon maintains. First there is the so called "simple protocol" which is used exclusively by avahi-dnsconfd (a daemon which configures unicast DNS servers using server info published via mDNS) and nss-mdns (a libc NSS plugin, providing name resolution via mDNS). Finally there is the D-Bus interface which provides a rich object oriented interface to D-Bus enabled applications.

Upon startup avahi-daemon interprets its configuration file /etc/avahi/avahi-daemon.conf and reads XML fragments from /etc/avahi/services/*.service which may define static DNS-SD services. If you enable publish-resolv-conf-dns-servers in avahi-daemon.conf the file /etc/resolv.conf will be read, too.

## OPTIONS
-f | --file= FILE

Specify the configuration file to read. (default: /etc/avahi/avahi-daemon.conf)

-D | --daemonize

Daemonize after startup. Implies --syslog.

-s | --syslog

Log to syslog instead of STDERR. Implied by --daemonize.

--debug

Increase verbosity to debug level.

--no-rlimits

Don't enforce resource limits as specified in the configuration file. (See setrlimit(2) for more information)

--no-drop-root

Don't drop root privileges after startup and don't require daemon to be started as root. We recommend not to use this option.

--no-chroot

Don't chroot(2) the daemon. This option is only available when compiled with chroot() support.

--no-proc-title

Don't change the process name while running. Unless this option is specified avahi-daemon will reflect its current state and the selected host name in the process title.

-k | --kill

Kill an already running avahi-daemon. (equivalent to sending a SIGTERM)

-r | --reload

Tell an already running avahi-daemon to reread /etc/resolv.conf (in case you enabled publish-resolv-conf-dns-servers in avahi-daemon.conf) and the files from /etc/avahi/services/. Please note that this will not reload the /etc/avahi/avahi-daemon.conf. (equivalent to sending a SIGHUP)

-c | --check

Return 0 as return code when avahi-daemon is already running.

-h | --help

Show help

-v | --version

Show version information

## FILES
/etc/avahi/avahi-daemon.conf: the default configuration file for avahi-daemon, see avahi-daemon.conf(5) for more information.

/etc/avahi/hosts: additional static hostname mappings to publish in mDNS, see avahi.hosts(5) for more information.

/etc/avahi/services/*.service: static service definitions, see avahi.service(5) for more information.

## SIGNALS
SIGINT, SIGTERM: avahi-daemon will shutdown. (Same as --kill).

SIGHUP: avahi-daemon will reload unicast DNS server data from /etc/resolv.conf and static service definitions from /etc/avahi/services/. (Same as --reload)

SIGUSR1: avahi-daemon will dump local and remote cached resource record data to syslog.

## AUTHORS
The Avahi Developers <avahi (at) lists (dot) freedesktop (dot) org>; Avahi is available from http://avahi.org/

## SEE ALSO
avahi-daemon.conf(5), avahi.hosts(5), avahi.service(5), avahi-dnsconfd(8), avahi-set-host-name(1)

http://avahi.org/wiki/AvahiAndUnicastDotLocal documents the problems when using Avahi in a unicast DNS zone .local.

## COMMENTS
This man page was written using xml2man(1) by Oliver Kurth.


avahi-dnsconfd

package: avahi-dnsconfd

title: avahi-dnsconfd(8)

text:
# avahi-dnsconfd(8)

## NAME
avahi-dnsconfd - Unicast DNS server from mDNS/DNS-SD configuration daemon

## SYNOPSIS
avahi-dnsconfd [options]

avahi-dnsconfd --kill

avahi-dnsconfd --refresh

avahi-dnsconfd --check

## DESCRIPTION
avahi-dnsconfd connects to a running avahi-daemon and runs the script /etc/avahi/avahi-dnsconfd.action for each unicast DNS server that is announced on the local LAN. This is useful for configuring unicast DNS servers in a DHCP-like fashion with mDNS.

## OPTIONS
-D | --daemonize

Daemonize after startup and redirect log messages to syslog.

-s | --syslog

Log to syslog instead of STDERR. Implied by --daemonize.

-k | --kill

Kill an already running avahi-dnsconfd. (equivalent to sending a SIGTERM)

-r | --refresh

Tell an already running avahi-dnsconfd to refresh the DNS server data. (equivalent to sending a SIGHUP)

-c | --check

Return 0 as return code when avahi-dnsconfd is already running.

-h | --help

Show help

-v | --version

Show version information

## FILES
/etc/avahi/avahi-dnsconfd.action: the script to run when a DNS server is found or removed.

## SIGNALS
SIGINT, SIGTERM: avahi-dnsconfd will shutdown. This is issued by passing --kill to avahi-daemon.

SIGHUP: avahi-dnsconfd will refresh the DNS server data.

## AUTHORS
The Avahi Developers <avahi (at) lists (dot) freedesktop (dot) org>; Avahi is available from http://avahi.org/

## SEE ALSO
avahi-daemon(8), avahi-dnsconfd.action(8)

## COMMENTS
This man page was written using xml2man(1) by Oliver Kurth.


avahi-dnsconfd.action

title: avahi-dnsconfd.action(8)

summary: avahi-dnsconfd action script

text:
# avahi-dnsconfd.action(8)

## NAME
avahi-dnsconfd.action - avahi-dnsconfd action script

## SYNOPSIS
/etc/avahi/avahi-dnsconfd.action

## DESCRIPTION
avahi-dnsconfd.action is the action script that is called whenever a new unicast DNS server is found or removed by avahi-dnsconfd. The default script as shipped with avahi patches /etc/resolv.conf to reflect the changed unicast DNS server configuration.

## PARAMETERS
argv[1] Contains the character "+" if the DNS server is new, "-" when it shall be removed from the DNS server list.

argv[2] The IP address of the DNS server.

argv[3] Numerical network interface number this DNS server was found on.

argv[4] Numerical protocol number this DNS server was found on. (usually 2 for IPv4 and 10 for IPv6)

## ENVIRONMENT
AVAHI_INTERFACE Contains the textual interface name the corresponds with argv[3]. (e.g. "eth0")

AVAHI_INTERFACE_DNS_SERVERS Contains a list of all DNS servers that avahi-dnsconfd found on the interface $AVAHI_INTERFACE, separated by spaces.

AVAHI_DNS_SERVERS Contains a list of all DNS server that avahi-dnsconfd found on all interfaces, separated by spaces.

## AUTHORS
The Avahi Developers <avahi (at) lists (dot) freedesktop (dot) org>; Avahi is available from http://avahi.org/

## SEE ALSO
avahi-dnsconfd(8), avahi-daemon(8)

## COMMENTS
This man page was written using xml2man(1) by Oliver Kurth.


ayatana-settings

package: ayatana-settings

title: ayatana-settings(8)

text:
# ayatana-settings(8)

## NAME
ayatana-settings - Fine-tune behaviour of Ayatana System Indicators

## SYNOPSIS

ayatana-settings

[ options ]

## DESCRIPTION
Ayatana (System) Indicators are a set of notification tray icons that are available for desktop environments that provide an Indicator Renderer applet. With Ayatana System Indicators users can get easy access to various system properties and settings (e.g. sound, events, messages and notifications, session management, bluetooth, etc.).

ayatana-settings is a graphical tool supplementing the desktop environment's control center / settings area and allows the user to fine-tune the behaviour of Ayatana System Indicators.

## COMMON OPTIONS
ayatana-settings does not have any command line options (except those provided by standard GTK applications).

## FILES
~/.config/autostart/ayatana-indicator-*.desktop

## AUTHOR
This manual has been written for the Ayatana Indicators project by Mike Gabriel <mike.gabriel@das-netzwerkteam.de>.


bacula-fd

title: bacula-fd(8)

summary: Bacula's File Daemon

text:
# bacula-fd(8)

## NAME
bacula-fd - Bacula's File Daemon

## SYNOPSIS
bacula-fd [options]

## DESCRIPTION
This manual page documents briefly the bacula command.

Bacula's File Daemon acts as the interface between the Bacula network backup system and the filesystems to be backed up: it is responsible for reading/writing/verifying the files to be backup'd/verified/restored. Network transfer can optionally be compressed.

## OPTIONS
-c file

Specify the configuration file to use.

-d nn

Set debug level to nn.

-dt

Print timestamp in debug output.

-T

Send debug messages to the trace file.

-f

Run in foreground (for debugging).

-g group

Set the group/gid to run as.

-k

Keep readall permission when dropping privileges.

-m

Print kaboom output (for debugging).

-P

Do not create a PID file.

-s

No signals (for debugging).

-t

Test the configuration file and report errors.

-u user

Set the username/uid to run as.

-v

Set verbose mode.

-?

Show version and usage of program.

## SEE ALSO
bacula-dir(8), bacula-sd(8).

## AUTHOR
This manual page was written by Jose Luis Tallon <jltallon@adv-solutions.net>.

## COPYRIGHT
This man page document is released under the BSD 2-Clause license.


bacula

title: bacula(8)

summary: The Network Backup Solution

text:
# bacula(8)

## NAME
Bacula - The Network Backup Solution

## SYNOPSIS
bacula-dir - Director

bacula-fd - File daemon or Client

bacula-sd - Storage daemon

bconsole - Console to control Bacula

## DESCRIPTION
Bacula is a set of computer programs that permits you (or the system administrator) to manage backup, recovery, and verification of computer data across a network of computers of different kinds. In technical terms, it is a network Client/Server based backup program. Bacula is relatively easy to use and efficient, while offering many advanced storage management features that make it easy to find and recover lost or damaged files. Due to its modular design, Bacula is scalable from small single computer systems to systems consisting of hundreds of computers located over a large network.

Bacula Director service consists of the program that supervises all the backup, restore, verify and archive operations. The system administrator uses the Bacula Director to schedule backups and to recover files. For more details see the Director Services Daemon Design Document in the Bacula Developer's Guild. The Director runs as a daemon or a service (i.e. in the background).

Bacula Console services is the program that allows the administrator or user to communicate with the Bacula Director (see above). Currently, the Bacula Console is available in two versions. The first and simplest is to run the Console program in a shell window (i.e. TTY interface). Most system administrators will find this completely adequate. The second version is a Qt 4.2 GUI interface named bat that has more features than the bconsole program.

Bacula File services (or Client program) is the software program that is installed on the machine to be backed up. It is specific to the operating system on which it runs and is responsible for providing the file attributes and data when requested by the Director. The File services are also responsible for the file system dependent part of restoring the file attributes and data during a recovery operation. For more details see the File Services Daemon Design Document in the Bacula Developer's Guide. This program runs as a daemon on the machine to be backed up, and in some of the documentation, the File daemon is referred to as the Client (for example in Bacula's configuration file). In addition to Unix/Linux File daemons, there is a Windows File daemon (normally distributed in binary format). The Windows File daemon runs on all currently known Windows versions (2K, 2003, XP, and Vista).

Bacula Storage services consist of the software programs that perform the storage and recovery of the file attributes and data to the physical backup media or volumes. In other words, the Storage daemon is responsible for reading and writing your tapes (or other storage media, e.g. files). For more details see the Storage Services Daemon Design Document in the Bacula Developer's Guide. The Storage services runs as a daemon on the machine that has the backup device (usually a tape drive).

Catalog services are comprised of the software programs responsible for maintaining the file indexes and volume databases for all files backed up. The Catalog services permit the System Administrator or user to quickly locate and restore any desired file. The Catalog services sets Bacula apart from simple backup programs like tar and bru, because the catalog maintains a record of all Volumes used, all Jobs run, and all Files saved, permitting efficient restoration and Volume management. Bacula currently supports three different databases, MySQL, PostgreSQL, and SQLite3, one of which must be chosen when building Bacula.

## OPTIONS
See the HTML/PDF documentation at:

<http://www.bacula.org>

for details of the command line options.

## CONFIGURATION
Each daemon has its own configuration file which must be tailored for each particular installation. Please see the HTML/PDF documentation for the details.

## SEE ALSO
The HTML manual installed on your system (typically found in

/usr/share/doc/bacula-<version>) or the online manual at:

<http://www.bacula.org>

## BUGS
See <http://bugs.bacula.org>

## AUTHOR
Kern Sibbald

### Current maintainer
Kern Sibbald

### Contributors
An enormous list of past and former persons who have devoted their time and energy to this project -- thanks. See the AUTHORS file in the main Bacula source directory.

## COPYRIGHT
This man page document is released under the BSD 2-Clause license.


bconsole

title: bconsole(8)

summary: Bacula's management Console

text:
# bconsole(8)

## NAME

bconsole - Bacula's management Console

## SYNOPSIS
bconsole [options]

## DESCRIPTION
This manual page documents briefly the bconsole command.

## OPTIONS
-D dir

Select a Director.

-l

List defined Directors.

-c config

Specify configuration file.

-d nn

Set debug level to nn.

-dt

Print timestamp in debug output.

-n

No conio (for scripting).

-s

No signals (for debugging).

-u nn

Set command execution timeout to nn seconds.

-t

Test the configuration file and report errors.

-?

Show version and usage of program.

## SEE ALSO
bacula-dir(8), bls(1), bextract(1).

## AUTHOR
This manual page was written by Jose Luis Tallon <jltallon@adv-solutions.net>.

## COPYRIGHT
This man page document is released under the BSD 2-Clause license.


btraceback

title: btraceback(8)

summary: wrapper script around gdb and bsmtp

text:
# btraceback(8)

## NAME

btraceback - wrapper script around gdb and bsmtp

## SYNOPSIS
btraceback /path/to/binary pid

## DESCRIPTION
btraceback is a wrapper shell script around the gdb debugger (or dbx on Solaris systems) and bsmtp, provided for debugging purposes.

## USAGE
btraceback is called by the exception handlers of the Bacula daemons during a crash. It can also be called interactively to view the current state of the threads belonging to a process, but this is not recommended unless you are trying to debug a problem (see below).

## NOTES
In order to work properly, debugging symbols must be available to the debugger on the system, and gdb, or dbx (on Solaris systems) must be available in the $PATH.

If the Director or Storage daemon runs under a non-root uid, you will probably need to be modify the btraceback script to elevate privileges for the call to gdb/dbx, to ensure it has the proper permissions to debug when called by the daemon.

Although Bacula's use of btraceback within its exception handlers is always safe, manual or interactive use of btraceback is subject to the same risks than live debugging of any program, which means it could cause Bacula to crash under rare and abnormal circumstances. Consequently we do not recommend manual use of btraceback in production environments unless it is required for debugging a problem.

## ENVIRONMENT
btracback relies on $PATH to find the debugger.

## FILES
/usr/lib/bacula/btraceback

The script itself.

/usr/sbin/btraceback

symbolic link to /usr/lib/bacula/btraceback

/etc/bacula/scripts/btraceback.gdb

the GDB command batch used to output a stack trace

## AUTHOR
This manual page was written by Lucas B. Cohen <lbc@members.fsf.org>

## SEE ALSO
bsmtp(1) This man page document is released under the BSD 2-Clause license.


bacula-dir

title: bacula-dir(8)

summary: Bacula Director

text:
# bacula-dir(8)

## NAME
bacula-dir - Bacula Director

## SYNOPSIS
bacula-dir [options]

## DESCRIPTION
This manual page documents briefly the bacula-dir command.

Bacula's Director Daemon acts as the controller of the network backup system: it is responsible for scheduling and coordinating backups across the network.

## OPTIONS
-c file

Specify the configuration file to use.

-d nn

Set debug level to nn.

-dt

Print timestamp in debug output.

-T

Send debug messages to the trace file.

-f

Run in foreground (for debugging).

-g group

Set the group/gid to run as.

-m

Print kaboom output (for debugging).

-P

Do not create a PID file.

-r job

Run <job>.

-s

No signals (for debugging).

-t

Test the configuration file and report errors.

-u user

Set the username/uid to run as.

-v

Set verbose mode.

-?

Show version and usage of program.

## TCP-WRAPPERS CONFIGURATION
Tcpwrappers looks for the service name of the bacula daemons in hosts.allow , and the service names of these daemons is configured to be different from the binary. The service names are configured to be %hostname%-%component% rather than bacula-dir (As defined in the bacula-dir.conf.in file)

So the hosts.allow entry has to match %hostname%-%component% (servername-dir for example) instead of bacula-%component%

WARNING: This means that if the hosts.allow file has the entry:

bacula-dir: ALL

you will not be able to run bconsole to connect to the local director!

The entry would have to read:

server-dir: ALL

and this will allow the console to connect to the director. (The process running is bacula-dir.)

## SEE ALSO
bacula-fd(8), bacula-sd(8).

## AUTHOR
This manual page was written by Jose Luis Tallon <jltallon@adv-solutions.net>.

## COPYRIGHT
This man page document is released under the BSD 2-Clause license.


bcopy

title: bcopy(8)

summary: Bacula's 'Copy from tape'

text:
# bcopy(8)

## NAME

bcopy - Bacula's 'Copy from tape'

## SYNOPSIS
bcopy [options] input-archive output-archive

## DESCRIPTION
This manual page documents briefly the bcopy command.

## OPTIONS
A summary of options is included below.

-?

Show version and usage of program.

-b bootstrap

Specify a bootstrap file.

-c config

Specify configuration file.

-d nn

Set debug level to nn.

-dt

Print timestamp in debug output.

-i input

Specify input Volume names (separated by '|')

-o output

Specify output Volume names (separated by '|')

-p

Proceed in spite of I/O errors.

-w directory

Specify working directory (default /tmp).

-v

Set verbose mode.

## SEE ALSO
bls(1), bextract(1).

## AUTHOR
This manual page was written by Jose Luis Tallon <jltallon@adv-solutions.net>.

## COPYRIGHT
This man page document is released under the BSD 2-Clause license.


bregex

title: bregex(8)

summary: Bacula's 'regex' engine

text:
# bregex(8)

## NAME

bregex - Bacula's 'regex' engine

## SYNOPSIS
bregex [options] -f <data-file>

## DESCRIPTION
This manual page documents briefly the bregex command.

This program can be useful for testing regex expressions to be applied against a list of filenames.

## OPTIONS
A summary of options is included below.

-?

Show version and usage of program.

-d nn

Set debug level to nn.

-dt

Print timestamp in debug output

-f <data-file>

The data-file is a filename that contains lines of data to be matched (or not) against one or more patterns. When the program is run, it will prompt you for a regular expression pattern, then apply it one line at a time against the data in the file. Each line that matches will be printed preceded by its line number. You will then be prompted again for another pattern.

-n

Print lines that do not match

-l

Suppress lines numbers.

## SEE ALSO
regex(7)

## AUTHOR
This manual page was written by Bruno Friedmann <bruno@ioda-net.ch>. This man page document is released under the BSD 2-Clause license.


bscan

title: bscan(8)

summary: Bacula's 'Scan tape'

text:
# bscan(8)

## NAME

bscan - Bacula's 'Scan tape'

## SYNOPSIS
bscan [options] bacula-archive

## DESCRIPTION
The purpose of bscan is to read (scan) a Bacula Volume and to recreate or update the database contents with the information found on the Volume. This is done in a non-destructive way. This permits restoring database entries that have been lost by pruning, purging, deleting, or a database corruption problem.

Normally, it should not be necessary to run the bscan command because the database is self maintaining, and most corrupted databases can be repaired by the tools provided by the database vendors. In addition, if you have maintained bootstrap files during backups, you should be able to recover all your data from the bootstrap file without needed an up to date catalog.

bscan command.

## OPTIONS
A summary of options is included below.

-?

Show version and usage of program.

-b bootstrap

Specify a bootstrap file.

-c config

Specify configuration file.

-d nn

Set debug level to nn.

-dt

Print timestamp in debug output.

-m

Update media info in database.

-D

Specify the driver database name (default: NULL)

-n name

Specify the database name (default: bacula)

-u username

Specify database username (default: bacula)

-P password

Specify database password (default: none)

-h host

Specify database host (default: NULL)

-t port

Specify database port (default: 0)

-p

Proceed in spite of I/O errors.

-r

List records.

-s

Synchronize or store in Database.

-S

Show scan progress periodically.

-v

Verbose output mode.

-V volume

Specify volume names (separated by '|')

-w dir

Specify working directory (default from conf file)

## SEE ALSO
bls(8), bextract(8).

## AUTHOR
This manual page was written by Jose Luis Tallon <jltallon@adv-solutions.net>, for the Debian GNU/Linux system (but may be used by others).

## COPYRIGHT
This man page document is released under the BSD 2-Clause license.


bwild

title: bwild(8)

summary: Bacula's 'wildcard' engine

text:
# bwild(8)

## NAME

bwild - Bacula's 'wildcard' engine

## SYNOPSIS
bwild [options] -f <data-file>

## DESCRIPTION
This manual page documents briefly the bwild command.

This is a simple program that will allow you to test wild-card expressions against a file of data.

## OPTIONS
A summary of options is included below.

-?

Show version and usage of program.

-d nn

Set debug level to nn.

-dt

Print timestamp in debug output

-f <data-file>

The data-file is a filename that contains lines of data to be matched (or not) against one or more patterns. When the program is run, it will prompt you for a wild-card pattern, then apply it one line at a time against the data in the file. Each line that matches will be printed preceded by its line number. You will then be prompted again for another pattern.

Enter an empty line for a pattern to terminate the program. You can print only lines that do not match by using the -n option, and you can suppress printing of line numbers with the -l option.

-n

Print lines that do not match

-l

Suppress lines numbers.

-i

use case insensitive match.

## SEE ALSO
fnmatch(3)

## AUTHOR
This manual page was written by Bruno Friedmann <bruno@ioda-net.ch>. This man page document is released under the BSD 2-Clause license.


dbcheck

title: dbcheck(8)

text:
# dbcheck(8)

## NAME

dbcheck - Bacula's Catalog Database Check/Clean program

## SYNOPSIS
dbcheck [options] working-directory bacula-database user password [dbhost] [dbport]

## DESCRIPTION
This manual page documents briefly the dbcheck command.

dbcheck will not repair your database if it is broken. Please see your vendor's instructions for fixing broken database.

dbcheck is a simple program that will search for logical inconsistencies in the Bacula tables in your database, and optionally fix them. It is a database maintenance routine, in the sense that it can detect and remove unused rows, but it is not a database repair routine. To repair a database, see the tools furnished by the database vendor. Normally dbcheck should never need to be run, but if Bacula has crashed or you have a lot of Clients, Pools, or Jobs that you have removed, it could be useful.

## OPTIONS
A summary of options is included below.

-?

Show version and usage of program.

-b

If specified, dbcheck will run in batch mode, and it will proceed to examine and fix (if -f is set) all programmed inconsistency checks. By default, dbcheck will enter interactive mode (see below).

-C catalog

catalog name in the director conf file.

-c config

If the -c option is given with the Director's conf file, there is no need to enter any of the command line arguments, in particular the working directory as dbcheck will read them from the file.

-B

print catalog configuration and exit.

-d nn

set debug level to nn.

-dt

print timestamp in debug output.

-f

If specified, dbcheck will repair (fix) the inconsistencies it finds. Otherwise, it will report only.

-v

Set verbose mode.

## INTERACTIVE MODE
In interactive mode dbcheck will prompt with the following:

Hello, this is the database check/correct program. Please select the function you want to perform.

1) Toggle modify database flag

2) Toggle verbose flag

3) Repair bad Filename records

4) Repair bad Path records

5) Eliminate duplicate Filename records

6) Eliminate duplicate Path records

7) Eliminate orphaned Jobmedia records

8) Eliminate orphaned File records

9) Eliminate orphaned Path records

10) Eliminate orphaned Filename records

11) Eliminate orphaned FileSet records

12) Eliminate orphaned Client records

13) Eliminate orphaned Job records

14) Eliminate all Admin records

15) Eliminate all Restore records

16) All (3-15)

17) Quit Select function number:

By entering 1 or 2, you can toggle the modify database flag (-f option) and the verbose flag (-v). It can be helpful and reassuring to turn off the modify database flag, then select one or more of the consistency checks (items 3 through 9) to see what will be done, then toggle the modify flag on and re-run the check.

The inconsistencies examined are the following:

Duplicate filename records. This can happen if you accidentally run two

copies of Bacula at the same time, and they are both adding filenames

simultaneously. It is a rare occurrence, but will create an

inconsistent database. If this is the case, you will receive error

messages during Jobs warning of duplicate database records. If you are

not getting these error messages, there is no reason to run this check.

Repair bad Filename records. This checks and corrects filenames that have

a trailing slash. They should not.

Repair bad Path records. This checks and corrects path names that do not

have a trailing slash. They should.

Duplicate path records. This can happen if you accidentally run two copies

of Bacula at the same time, and they are both adding filenames

simultaneously. It is a rare occurrence, but will create an

inconsistent database. See the item above for why this occurs and how

you know it is happening.

Orphaned JobMedia records. This happens when a Job record is deleted

(perhaps by a user issued SQL statement), but the corresponding JobMedia

record (one for each Volume used in the Job) was not deleted. Normally,

this should not happen, and even if it does, these records generally do

not take much space in your database. However, by running this check,

you can eliminate any such orphans.

Orphaned File records. This happens when a Job record is deleted (perhaps

by a user issued SQL statement), but the corresponding File record (one

for each Volume used in the Job) was not deleted. Note, searching for

these records can be very time consuming (i.e. it may take hours) for a

large database. Normally this should not happen as Bacula takes care to

prevent it. Just the same, this check can remove any orphaned File

records. It is recommended that you run this once a year since orphaned

File records can take a large amount of space in your database. You

might want to ensure that you have indexes on JobId, FilenameId, and

PathId for the File table in your catalog before running this command.

Orphaned Path records. This condition happens any time a directory is

deleted from your system and all associated Job records have been

purged. During standard purging (or pruning) of Job records, Bacula

does not check for orphaned Path records. As a consequence, over a

period of time, old unused Path records will tend to accumulate and use

space in your database. This check will eliminate them. It is

recommended that you run this check at least once a year.

Orphaned Filename records. This condition happens any time a file is

deleted from your system and all associated Job records have been

purged. This can happen quite frequently as there are quite a large

number of files that are created and then deleted. In addition, if you

do a system update or delete an entire directory, there can be a very

large number of Filename records that remain in the catalog but are no

longer used.

During standard purging (or pruning) of Job records, Bacula does not

check for orphaned Filename records. As a consequence, over a period of

time, old unused Filename records will accumulate and use space in your

database. This check will eliminate them. It is strongly recommended

that you run this check at least once a year, and for large database

(more than 200 Megabytes), it is probably better to run this once every

6 months.

Orphaned Client records. These records can remain in the database long

after you have removed a client.

Orphaned Job records. If no client is defined for a job or you do not run

a job for a long time, you can accumulate old job records. This option

allow you to remove jobs that are not attached to any client (and thus

useless).

All Admin records. This command will remove all Admin records,

regardless of their age.

All Restore records. This command will remove all Restore records,

regardless of their age.

By the way, I personally run dbcheck only where I have messed up my database due to a bug in developing Bacula code, so normally you should never need to run dbcheck inspite of the recommendations given above, which are given so that users don't waste their time running dbcheck too often.

## SEE ALSO
bls(1), bextract(1).

## AUTHOR
This manual page was written by Jose Luis Tallon <jltallon@adv-solutions.net>.

## COPYRIGHT
This man page document is released under the BSD 2-Clause license.