[Aide] syntax error when trying to run aide

[Keith Constable]

On 28 Aug 2013, at 5:52 PM, Andy Kannberg <andy.kannberg at gmail.com> wrote:

> Hi again. 
> 
> The problem I have is this:
> 
> When I ran aide --check, I saw a lot of /etc/selinux files that were changed.
> In my infinite wisdom *cough* I added this line to the aide.conf:
> 
> /etc/selinux LSPP
> 
> In the understanding that when I would add the directory, things would be ok.
> 
> Well, I was wrong. When I tried running aide --check, the following is shown on the screen:
> 
> # aide --check
> 84:syntax error:l
> 84:Error while reading configuration:l
> Configuration error
> 
> 
> I removed the line from the config file again, but the error kept appearing.
> Googling on this wasn't very succesfull. If someone can help me with this, I would appreciate it !
> 
> my aide.conf: (quite default):
> 
> # Example configuration file for AIDE.
-- SNIP --
> # Some files get updated automatically, so the inode/ctime/mtime change
> # but we want to know when the data inside them changes
> r
> DATAONLY =  p+n+u+g+s+acl+selinux+xattrs+md5+sha256+rmd160+tiger
-- SNIP --
> cheers,
> Andy


It seems to be complaining about the random 'r' character on the line above DATAONLY. That is line 84 in your configuration. However, why it appears as 'r' here when the program complains about an 'l', I'm not sure. Remove that line or, better yet, compare your configuration to the default for your distribution to make sure you didn't accidentally replace whole line with that single character.

In addition, I do not see where you added the /etc/selinux rule as you have claimed. Are you certain you added it?

Regards,

Keith Constable



-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2849 bytes
Desc: not available
Url : https://mailman.cs.tut.fi/pipermail/aide/attachments/20130828/f51f2382/attachment.bin