Home / server / Questions / 808174
In Process
Pavel Niedoba
Asked: 2016-10-11 08:23:18 +0800 CST

sealert takes very long on centos7

  • 772

I'm trying to human read /var/log/audit/audit.log file on centos7. I came with command 

sealert -a /var/log/audit/audit.log

which works fine on one machine, there is initial scan which takes second or so, but on another one scan goes on for about 30 minutes and is still on 40%. It cannot be stopped by ctrl-c. I also tried to remove audit.log so it's almost empty but there was no speedup.

Both of these machines are virtual and run on same host

I found out that many alerts were generated by my apache, so I disabled selinux using 

setenforce 0

and removed old audit.log.X files but its still same slow (and keeps slowing so it might never finish) sealert process is using one core permanently at 25% of CPU and 1gig of RAM.

is there any other way I can analyze selinux log files from cli ?

centos selinux

0 Answers