On Sun, 2005-01-23 at 21:22 +1000, Michael D. Setzer II wrote:
> Had to shut the machine down three times to be able to catch the
> whole error message, since it will not pause.
>
> Shutting down ntpd: audit(1106478493.061:0): avc: denied {write}
> for pid=2935 exe=/usr/sbin/ntpd name=log dev=tmpfs ino=5739
> scontext=user_u:system_r:ntpd_t tcontext=user_u:object_r:
> device_t tclass=sock_file
>
> The audit number and pid number change, not sure about the other
> number.
----
it would have been much easier to view in /var/log/messages - it is
certain to be there (note the day/time) of the shutdown that produces
the error and then when you restart, you will know where to find the
messages in /var/log/messages - aka - syslog
Craig
