From mboxrd@z Thu Jan  1 00:00:00 1970
From: Steve Grubb <sgrubb@redhat.com>
Subject: Re: aureport endless loop with specific input on Debian 8
Date: Sat, 5 Nov 2016 17:30:20 +0000
Message-ID: <20161105173020.266f2f02@ivy-bridge>
References: <4cb61e99-f114-d48a-768f-70e7e1df4331@gmail.com>
	<20161105143702.07cc65e2@ivy-bridge>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <20161105143702.07cc65e2@ivy-bridge>
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: Vincas Dargis <vindrg@gmail.com>
Cc: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On Sat, 5 Nov 2016 14:37:02 +0000
Steve Grubb <sgrubb@redhat.com> wrote:

> On Sat, 5 Nov 2016 15:05:32 +0200
> Vincas Dargis <vindrg@gmail.com> wrote:
> > I have reported bug in Debian bug tracker [1] that after upgrading
> > to Debian 8, aureport does not finish it's "reporting" for hours one
> > some inputs, generated by ausearch. It's stuck with 100% CPU
> > usage.  
> 
> If I read that correctly, this is against audit-2.4. There was linked
> list fixes to ausearch/report in 2.4.4. I suspect that fixes your bug
> report. Its not reproducible with the latest version.

Pretty sure this is the fix:
https://fedorahosted.org/audit/changeset?format=diff&new=1116&old=1114&new_path=%2Ftrunk&old_path=%2Ftrunk

-Steve


> > Since maintainer haven't responded yet, I though I could try for
> > help directly here.
> > 
> > More info, and two example input files for reproducing attached in
> > same bug report.
> > 
> > I wonder, would it be... "reasonable" to hope for some kind isolated
> > patch that Debian maintainer could apply and release fix for Debian
> > 8 which is currently in "stable" mode? I know it's kinda not the
> > mailing list to ask about it, but maybe you have experience in that
> > regard?
> > 
> > Thanks!
> > 
> > [1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=841272
> > 
> > --
> > Linux-audit mailing list
> > Linux-audit@redhat.com
> > https://www.redhat.com/mailman/listinfo/linux-audit  
> 
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit