sealert

What it does

How to write it

sealert -a FILE
sealert -l ID | -l "*"
sealert -b

Most used

Nothing matches this filter.

$ run as a normal user# run as root (or with sudo)

1. 1Install it

   #dnf install -y setroubleshoot-server

   Restart auditd or reboot so it gets the events.

2. 2Analyze the whole audit log

   #sealert -a /var/log/audit/audit.log | less

   One block per kind of denial, with fixes.

3. 3Short messages in the journal

   #journalctl -t setroubleshoot --since -1h
   setroubleshoot[2310]: SELinux is preventing /usr/sbin/httpd from read access on the file index.html. For complete SELinux messages run: sealert -l 3f6a…

   Copy the ID.

4. 4Full report for one alert

   #sealert -l 3f6a2b1c-…

   Cause and suggestions.

5. 5All alerts

   #sealert -l "*"

   Every stored alert.

6. 6Typical suggestion: wrong label

   #sealert -a /var/log/audit/audit.log | grep -A3 'restorecon'

   Run the restorecon it shows.

7. 7Typical suggestion: boolean

   #sealert -a /var/log/audit/audit.log | grep setsebool

   Use the boolean it names (with -P).

8. 8Do not just follow audit2allow advice (security)

   #sealert -a /var/log/audit/audit.log | grep -B2 audit2allow

   The last suggestion is often "make a module" — only if nothing else fits.

9. 9Analyze an old log

   #sealert -a /var/log/audit/audit.log.1

   Rotated logs.

10. 10Check the service

    #systemctl status setroubleshootd

    Runs on demand through D-Bus.

Nothing matches this filter.

Exit codes