From mboxrd@z Thu Jan 1 00:00:00 1970 From: Matthew Booth Subject: Auditd hangs hard Date: Fri, 08 Jun 2007 15:32:54 +0100 Message-ID: <1181313174.19818.8.camel@localhost.localdomain> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============0900735924==" Return-path: Received: from [192.168.250.110] (sebastian-int.corp.redhat.com [172.16.52.221]) by pobox.fab.redhat.com (8.13.1/8.13.1) with ESMTP id l59992Lw032281 for ; Sat, 9 Jun 2007 05:09:03 -0400 List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit List-Id: linux-audit@redhat.com --===============0900735924== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-D/huSzU3CW9jsLu/bIgN" --=-D/huSzU3CW9jsLu/bIgN Content-Type: text/plain Content-Transfer-Encoding: quoted-printable I have a test server on which, if left to its own devices, the audit daemon will lock up hard. The most obvious symptoms are: * An attempt to read /proc// will hang * auditd cannot be killed with -9 * The logs are full of backlog exceeded messages. The system in question is doing some fairly severe system call auditing. The audit daemon is configured not to write to disk at all. Instead it uses a custom dispatcher which directly wraps the audit messages as a syslog message and sends it directly via UDP to a central host. The change which prompted this behaviour seems to be the installation of LSF analytics, which is quite exceptionally noisy from a syscall POV. The system is RHEL 4 x86_64 running: audit-1.0.15-3.EL4 kernel-smp-2.6.9-42.0.8.EL It's basically RHEL 4 U4 with auditd from U5. Any ideas what might be causing this, or how to debug? Thanks, Matt --=20 Matthew Booth, RHCA, RHCSS Red Hat, Global Professional Services M: +44 (0)7977 267231 GPG ID: D33C3490 GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490 --=-D/huSzU3CW9jsLu/bIgN Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iD8DBQBGaWiWNEHqGdM8NJARAqRjAKCL9sQ8LUkRsdhqrIVFFZKL9BkjDwCgjwox H4Ig5f1NH7MIL/gCBvkeQSc= =X301 -----END PGP SIGNATURE----- --=-D/huSzU3CW9jsLu/bIgN-- --===============0900735924== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============0900735924==--