diff -urp audit-2.7.7.orig/src/aureport-scan.c audit-2.7.7/src/aureport-scan.c --- audit-2.7.7.orig/src/aureport-scan.c 2017-03-27 18:21:19.000000000 -0400 +++ audit-2.7.7/src/aureport-scan.c 2017-06-08 16:06:48.232990012 -0400 @@ -452,7 +452,8 @@ static int per_event_summary(llist *l) } else { if (list_find_msg_range(l, AUDIT_FIRST_KERN_ANOM_MSG, - AUDIT_LAST_KERN_ANOM_MSG)) { + AUDIT_LAST_KERN_ANOM_MSG) || + list_find_msg(l, AUDIT_SECCOMP) ) { ilist_add_if_uniq(&sd.anom_list, l->head->type, 0); } @@ -729,7 +730,8 @@ static int per_event_detailed(llist *l) } else { if (list_find_msg_range(l, AUDIT_FIRST_KERN_ANOM_MSG, - AUDIT_LAST_KERN_ANOM_MSG)) { + AUDIT_LAST_KERN_ANOM_MSG) || + list_find_msg(l, AUDIT_SECCOMP) ) { print_per_event_item(l); rc = 1; } diff -urp audit-2.7.7.orig/src/ausearch-parse.c audit-2.7.7/src/ausearch-parse.c --- audit-2.7.7.orig/src/ausearch-parse.c 2017-03-27 18:21:19.000000000 -0400 +++ audit-2.7.7/src/ausearch-parse.c 2017-06-08 16:00:13.856999833 -0400 @@ -2080,7 +2080,7 @@ static int parse_kernel_anom(const lnode str = strstr(term, "exe="); if (str) { str += 4; - if (*str == '"') { + if (*str == '"') { str++; term = strchr(str, '"'); if (term == NULL) @@ -2090,7 +2090,7 @@ static int parse_kernel_anom(const lnode *term = '"'; } else s->exe = unescape(str); - } else + } else if (n->type != AUDIT_ANOM_ABEND) return 14; }