sealert(1)
Analyze and display SELinux policy violation alerts from the audit log.
Synopsis
sealert [OPTIONS] [-a FILE] [-l ALERT_ID]Description
sealert is a tool that parses SELinux audit messages and generates human-readable summaries with suggested policy changes or workarounds. It reads from the audit daemon log and presents violations in an understandable format, often recommending whether to generate new policies, adjust existing ones, or modify file contexts.
The tool can operate in analysis mode to examine recorded violations, or in daemon mode to monitor for new alerts. It's essential for troubleshooting SELinux denials and understanding why applications are being blocked.
Common options
| Flag | What it does |
|---|---|
-a FILE | Analyze audit log file; scans FILE for SELinux violations and generates reports |
-l ALERT_ID | Display details for a specific alert ID from the sealert database |
-r | Generate and display a report of all unreviewed alerts |
-d | Run in daemon mode; monitor audit log continuously for new violations |
-b | Generate policy based on analysis; output suggested policy module |
-f POLICY_FILE | Generate policy file from analysis; compile and load generated policy |
-t ALERT_TYPE | Filter alerts by type (e.g., boolean, interface, file_context) |
-c | Clean; clear all reviewed alerts from the sealert database |
-D | Delete; remove all alerts from the sealert database |
--summary | Show summary statistics of current alerts only |
Examples
Generate a report of all unreviewed SELinux alerts in the system
sealert -rAnalyze the audit log file and display all detected SELinux violations with explanations
sealert -a /var/log/audit/audit.logShow detailed information for a specific alert ID stored in the sealert database
sealert -l selinux-restorecon-1234567890Start sealert daemon to continuously monitor and report new SELinux violations
sealert -dAnalyze audit log and generate suggested policy module based on violations found
sealert -a /var/log/audit/audit.log -bDisplay all unreviewed alerts filtered to show only interface-related violations
sealert -t interface -rClear all reviewed alerts from the sealert database
sealert -cPipe live audit log to sealert for real-time analysis of SELinux violations
tail -f /var/log/audit/audit.log | sealert -a -