Auditd hangs hard

[Matthew Booth <mbooth@redhat.com>]

[-- Attachment #1.1: Type: text/plain, Size: 1091 bytes --]

I have a test server on which, if left to its own devices, the audit
daemon will lock up hard. The most obvious symptoms are:

* An attempt to read /proc/<auditd pid>/ will hang
* auditd cannot be killed with -9
* The logs are full of backlog exceeded messages.

The system in question is doing some fairly severe system call auditing.
The audit daemon is configured not to write to disk at all. Instead it
uses a custom dispatcher which directly wraps the audit messages as a
syslog message and sends it directly via UDP to a central host. The
change which prompted this behaviour seems to be the installation of LSF
analytics, which is quite exceptionally noisy from a syscall POV.

The system is RHEL 4 x86_64 running:
audit-1.0.15-3.EL4
kernel-smp-2.6.9-42.0.8.EL

It's basically RHEL 4 U4 with auditd from U5. Any ideas what might be
causing this, or how to debug?

Thanks,

Matt
-- 
Matthew Booth, RHCA, RHCSS
Red Hat, Global Professional Services

M:       +44 (0)7977 267231
GPG ID:  D33C3490
GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490

[-- Attachment #1.2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]