From mboxrd@z Thu Jan 1 00:00:00 1970 From: Matthew Booth Subject: Re: Auditd hangs hard Date: Tue, 12 Jun 2007 09:50:27 +0100 Message-ID: <1181638227.26075.5.camel@localhost.localdomain> References: <1181313174.19818.8.camel@localhost.localdomain> <200706090759.06963.sgrubb@redhat.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============1977479887==" Return-path: In-Reply-To: <200706090759.06963.sgrubb@redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com --===============1977479887== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-E/Cgrk7KVlAiUBLCKWKP" --=-E/Cgrk7KVlAiUBLCKWKP Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On Sat, 2007-06-09 at 07:59 -0400, Steve Grubb wrote: > On Friday 08 June 2007 10:32:54 Matthew Booth wrote: > > I have a test server on which, if left to its own devices, the audit > > daemon will lock up hard. >=20 > Does boosting the priority so auditd runs more often help? I think it def= alts=20 > to 3, you can make it 10 for an experiment. Thanks, Steve. This put me on the right track. It turns out that not only is LSF very noisy, but it also runs itself with niceness -20. Renicing it to -5 and running auditd at -10 fixes the problem. I've asked the customer to raise an issue against LSF as this strikes me as a bug. It does strike me that audit could cope with overload much better, though. If it's configured to drop messages rather than kill the system, it could probably disable auditing entirely when the kernel buffer is full, and only re-enable it when there's enough space. Matt --=20 Matthew Booth, RHCA, RHCSS Red Hat, Global Professional Services M: +44 (0)7977 267231 GPG ID: D33C3490 GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490 --=-E/Cgrk7KVlAiUBLCKWKP Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iD8DBQBGbl5TNEHqGdM8NJARAsakAJwL5WfAQLIu0JBCZF11qG/vOyIyxgCeOAsx hfD0iIYPGNnYGEvpl3n1M50= =3ksD -----END PGP SIGNATURE----- --=-E/Cgrk7KVlAiUBLCKWKP-- --===============1977479887== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============1977479887==--