Title
#linux
Fran Rodríguez

Fran Rodríguez

06/18/2020, 4:08 PM
Hi someone know what this means:
I0618 16:07:50.096029 13511 auditdnetlink.cpp:616] Failed to acquire the netlink handle
sundsta

sundsta

06/18/2020, 4:09 PM
Usually it means osqueryd doesn’t have the permissions required to modify the audit settings (EG: not running as root or not having
CAP_AUDIT_CONTROL
)
4:10 PM
The lines preceding that should give you more info
Fran Rodríguez

Fran Rodríguez

06/18/2020, 4:12 PM
👌
4:12 PM
It is running as a root
4:23 PM
but im running osquery as root
4:32 PM
this is ubuntu 16.04