Show recent SELinux AVC denials
Build a paste-ready command, then review its compatibility and effects before running it.
ausearch -m AVC,USER_AVC -ts recent | tail -30read-onlyno known side effects Compatibility
LinuxVerified for Linux using posix, bash, zsh syntax.
Operational knowledgereview due 2027-01-20
Requirementsausearchausearch must be installed and available on PATH.
Version supportausearch Current supported releasesVerified for linux using posix, bash, zsh syntax; consult compatibility notes for platform-specific differences.
Expected signalstype=AVC msg=audit(1784887422.123:842): avc: denied { name_connect } for pid=842 comm="nginx" dest=9000 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:port_t:sRepresentative successful output; values vary with the selected target and system state.
Known errorsausearch: command not foundausearch is missing or is not available on PATH.
Verifyausearch -m AVC,USER_AVC -ts recent | tail -30The output matches the expected target and exits without an error.Rollback noteNot required: this command is read-only and does not change system state.
Command breakdown
01ausearchCommandRuns the ausearch stage of this one-liner.
02-mOptionConfigures ausearch with the -m option.
03AVC,USER_AVCArgumentPasses AVC,USER_AVC to ausearch.
04-tsOptionConfigures ausearch with the -ts option.
05recentArgumentPasses recent to ausearch.
06|PipelinePasses the output on the left to the command on the right.
07tailCommandRuns the tail stage of this one-liner.
08-30OptionConfigures tail with the -30 option.
Example input
ausearch -m AVC,USER_AVC -ts recent | tail -30
Example output
type=AVC msg=audit(1784887422.123:842): avc: denied { name_connect } for pid=842 comm="nginx" dest=9000 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=tcp_socket permissive=0
Illustrative output — exact values vary by system and data.
Official sources