SE alert

[Ed Greshko]

On 07/19/15 11:26, inode0 wrote:
> sa1 appears to be the culprit. It is normally run from a cronjob
> typically every 10 minutes.

See my other message....

[root at meimei ~]# systemctl is-enabled sysstat-collect.timer
enabled
[root at meimei ~]# systemctl is-enabled sysstat.service
enabled

If they are enabled, stop and disable them for the time being and check to see if the sealerts cease.

Also, check this label

[root at meimei ~]# ls -Z /usr/lib64/sa/sa1

system_u:object_r:sysstat_exec_t:s0 /usr/lib64/sa/sa1

/usr/lib64/sa/sa1 is a shell script and called very 10 minutes based on the settings in sysstat-collect.timer

 
-- 
If I wanted a blog or social media I'd go elsewhere