From mboxrd@z Thu Jan  1 00:00:00 1970
From: Steve Grubb <sgrubb@redhat.com>
Subject: Re: Crash when loading the rules
Date: Wed, 06 Jul 2016 11:23:50 -0400
Message-ID: <1835912.PABrHuQGvY@x2>
References: <bcca63cd-0435-7484-b597-48e083d7446e@debian.org>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <bcca63cd-0435-7484-b597-48e083d7446e@debian.org>
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On Wednesday, July 6, 2016 4:49:58 PM EDT Laurent Bigonville wrote:
> Hi,
> 
> With 2.6.3, when loading the rules, it's crashing and I get the
> following backtrace:
> 
> #0  0x00007ffff687e99d in writev () at ../sysdeps/unix/syscall-template.S:84
> #1  0x00005555555610ab in dispatch_event (rep=<optimized out>, is_err=0) at
> ../../../src/auditd-dispatch.c:189
> #2  0x000055555555a700 in distribute_event (e=0x555555779d80) at
> ../../../src/auditd.c:216
> #3  0x000055555555aac8 in netlink_handler (loop=<optimized out>,
> io=<optimized out>, revents=<optimized out>) at ../../../src/auditd.c:500
> #4  0x0000555555562eb7 in ev_invoke_pending (loop=0x555555773e80
> <default_loop_struct>) at ../../../../src/libev/ev.c:3162
> #5  0x000055555556623d in ev_run (loop=0x555555773e80
> <default_loop_struct>, flags=0) at ../../../../src/libev/ev.c:3562
> #6  0x0000555555559e06 in ev_loop (flags=0, loop=0x555555773e80
> <default_loop_struct>) at ../../../src/libev/ev.h:835
> #7  main (argc=<optimized out>, argv=<optimized out>) at
> ../../../src/auditd.c:841
> 
> The rules are pretty dump:
> 
> -D
> -b 8192
> -f 1
> --backlog_wait_time 0
> 
> An idea what's going on?

By any chance does syslog show that the dispatcher exited due to no active 
plugins?

-Steve