diff --git a/pages/linux/sealert.md b/pages/linux/sealert.md new file mode 100644 index 00000000000000..8af80b8a160f83 --- /dev/null +++ b/pages/linux/sealert.md @@ -0,0 +1,22 @@ +# sealert + +> Analyze and explain SELinux AVC denial messages. +> Part of the `setroubleshoot-server` package. +> See also: `audit2why`, `ausearch`, `audit2allow`. +> More information: . + +- Analyze all recent SELinux denials: + +`sudo sealert {{[-a|--analyze]}} {{/var/log/audit/audit.log}}` + +- Analyze a specific alert ID from system logs: + +`sudo sealert {{[-l|--lookupid]}} {{alert_id}}` + +- Display a summary of recent SELinux alerts: + +`sudo sealert {{[-b|--browser]}}` + +- Monitor audit log in real-time for new alerts: + +`sudo tail {{[-f|--follow]}} {{/var/log/audit/audit.log}} | sealert {{[-l|--lookupid]}} -`