8

I have hundreds of these log entries:

Feb 13 16:46:56 XXXX kernel: [42982.178922] type=1701 audit(1360799216.852:1514): auid=4294967295 uid=1000 gid=1000 ses=4294967295 pid=5529 comm="chrome" reason="seccomp" sig=0 syscall=2 compat=0 ip=0x7f3060b476b0 code=0x50000
Feb 13 16:46:56 XXXX kernel: [42982.178943] type=1701 audit(1360799216.852:1515): auid=4294967295 uid=1000 gid=1000 ses=4294967295 pid=5529 comm="chrome" reason="seccomp" sig=0 syscall=2 compat=0 ip=0x7f3060b476b0 code=0x50000

This behavior is explained here: Why is there "seccomp" events related to Google Chrome in syslog?.

How do I redirect them out of my kern.log file?

I plan to figure out this log later, but I have other projects that would be easier with a smaller kern.log file.

I have seen this: How to enable logging for Google Chrome in Ubuntu 12.04?

The file mentioned is not under my home folder.

Default install. Edit: Basic plug-ins. Single profile. Checked the menu item and the only option %U (no --debug or anything like that)

about:

Google Chrome   24.0.1312.69 (Official Build 180721)
OS  Linux 
WebKit  537.17 (@140072)
JavaScript  V8 3.14.5.6
Flash   11.5.31.139
User Agent  Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.17 (KHTML, like Gecko)
Chrome/24.0.1312.69 Safari/537.17
Improve this question
2
  • In the accepted answer. ~/.config/google-chrome or ~/.config/chrome has no .log file that I can find. I was assuming this is default behavior and I thought it was a good trouble shooting step. Should I remove the reference?
    – DarkSheep
    Feb 14, 2013 at 2:31
  • Okay, I checked syslog as well. No seccomp entry for me. What is your google-chrome version? Maybe you could add to your question information from typing about: in the address bar and hitting enter. I'm deleting my earlier comments before the system tries to push us into chat!
    – user25656
    Feb 14, 2013 at 2:49

3 Answers 3

Reset to default
2

If using an open source version of Chrome (like on Ubuntu the version installed with sudo apt-get install chromium-browser) then redirecting the seccomp logging requires a slightly-different rsyslogd filter.

For reference Chromium syslog messages look like this:

Feb 23 17:33:16 XXX kernel: [507549.071917] type=1701 audit(1393194796.933:3999): auid=4294967295 uid=1000 gid=1000 ses=4294967295 pid=21016 comm="chromium-browse" reason="seccomp" sig=0 syscall=2 compat=0 ip=0x7f2b40940eb0 code=0x50001

And building on stsquad's answer, here is an /etc/rsyslog.d/30-seccomp.conf that's been generalized to work with both Google Chrome and open source Chromium:

if $msg contains ' reason="seccomp"' and $msg contains ' comm="chrom' \
  then -/var/log/chrome-seccomp.log
& ~
Improve this answer
0

You'll need to tweak your rsyslog configuration to process those messages differently. So for example you can create /etc/rsyslog.d/30-seccomp.conf:

if $msg contains 'comm="chrome" reason="seccomp"' then /var/log/chrome.log
& ~

Followed by:

initctl restart syslog

The rule states if the message contains the string then forward it to /var/log/chrome.log. The second line means that anything that matched the first line should be dropped.

If you just want to drop all these messages:

if $msg contains 'comm="chrome" reason="seccomp"' then ~
Improve this answer
0

How about scripting a grep hack?

grep -Ev 'chrome' /var/log/kern.log >> /var/log/smaller.kern.log
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .