Fedora

So you have multiple cases of rpm database corruption in your Linux system and you want to investigate the cause of the corruption. Well, it's not easy, but we can surely give it a try. Stale lock files left behind in /var/lib/rpm can majorly cause the rpm database corruption. The rpm commands, in that case, would fail with an error similar to below: # rpm -qa error: rpmdb: BDB0113 Thread/process 5691/140201285396544 failed: BDB1507 Thread died in Berkeley DB library error: db5 error(-30973) … [Read more...] about Troubleshooting recurring rpm database corruption in Linux

Source rpm will include the source code. Alternatively, one may execute the below command to download the source rpm directly on the server. # yumdownloader --source [package name] For example, to get the source code for the net-snmp package, use the below command: # yumdownloader --source net-snmp Loaded plugins: product-id, rhnplugin This system is receiving updates from RHN Classic or RHN Satellite. net-snmp-5.5-50.el6_6.1.src.rpm … [Read more...] about How to extract source code from source rpm

Question: How to remove the older versions of a package which has multiple versions installed on CentOS/RHEL? After a failed yum transaction, yum-complete-transaction fails to complete and the duplicates are still present. When yum is interrupted during an update, it can leave the old versions installed in addition to the new packages it was updating to leaving duplicates. The next time yum is used, the duplicate packages cause confusion in yum's logic and it can fail with "protected … [Read more...] about How to remove duplicate packages from a failed yum transaction (when yum-complete-transaction fails to complete)

Question: How to configure auditd to change the default permissions on the /var/log/audit/audit.log from 0600 to 0640 and also changing the group ownership of the file? By default it's not possible to change permissions on the /var/log/audit/audit.log file using ACLs, instead "log_group" parameter can be set under the file /etc/audit/audit.conf. The Steps In this example, we would like to change default permissions on the /var/audit/audit.log from 600 to 640 and also changing group from … [Read more...] about How to change the default permissions on /var/log/audit/audit.log file in CentOS/RHEL

Question: A file seems to be disappearing and no direct reason for its disappearance can be found. How can we monitor the file access, especially the deletion of a particular file in CentOS/RHEL system? A file can be monitored through its lifecycle by using the Linux auditd service. The Steps 1. To install it on CentOS or RHEL, run: # yum install audit 2. To enable the service at boot time, run: # chkconfig auditd on # For CentOS/RHEL 6 # systemctl enable auditd # For … [Read more...] about A File Is Claimed to Be Disappearing – How to monitor a file for deletion in Linux

This post explains how to stop audit log entries written to system logs. 1. Check the file /etc/audisp/plugins.d/syslog.conf. By default, the file "/etc/audisp/plugins.d/syslog.conf will have the below line. args = LOG_INFO This will allow syslog to log audit logs into /var/log/messages. In addition audit.d will log all the audit events to /var/log/audit/audit.log too and this is the data normally we use to check audit events. 2. Duplicating the entries in /var/log/messages is not … [Read more...] about How to Stop Audit Log Entries Written to System Logs in CentOS/RHEL 6

Question: How to create audit rules for monitoring services start or stop? In order to monitor the service start and stop, you will need two audit rules in place. Add the following rules in the /etc/audit.rules or /etc/audit/rules.d/audit.rules depending on the version of CentOS/RHEL you are running. (1) A rule to monitor the start, or execution, of the service. For rsyslogd the rule may look like this. -w /sbin/rsyslogd -p x -k rsyslog_run (2) A rule to monitor the stop syscall for … [Read more...] about How to Monitor Service Start/Stop Operations using auditd

Question: How to change the minimum password length for a user in a CentOS/RHEL 7 box? What is the lowest minimum value possible for the password length? The easiest way to set the password lenght for users is to add or modify the "minlen" parameter in /etc/security/pwquality.conf. For example : $ cat /etc/security/pwquality.conf minlen= 6 However, the length can never be shorter than 6 characters. This is hardcoded into the pam_pwquality module shipped by Red Hat and therefore cannot … [Read more...] about How to change the minimum password length in CentOS/RHEL 7

For a kernel panic, kdump (CentOS/RHEL 5 and above) or netdump/diskdump (CentOS/RHEL 4 and earlier) can be configured within the guest just like on a bare metal system. In the event those services cannot capture a vmcore, such as the guest going unresponsive, qemu-kvm's monitor functionality can be used. The commands are slightly different for qemu-kvm/libvirt RHEL KVM guests and for RHEV guests: For qemu-kvm/libvirt RHEL KVM guests: # virsh dump domain-name /tmp/dumpfile --memory-only … [Read more...] about How to capture a vmcore from a KVM or RHEV guest