SUSE / linux-security-sensor

Linux security sensor
Other
18 stars 9 forks source link

Sensor base 0.6.7 #56

Closed jeffmahoney closed 1 year ago

jeffmahoney commented 1 year ago

sdjournal: work around missing _SYSTEMD_UNIT fields

There is a longstanding issue in systemd where it attempts to figure out who sent a message just after it received it. By the time it does, the process may have exited and it's unable to identify it.

For Velociraptor, this can result in errors like the following: [ERROR] 2023-01-12T10:22:30+01:00 Symbol _SYSTEMD_UNIT not found.

Systemd bug reference: https://github.com/systemd/systemd/issues/1347