From mboxrd@z Thu Jan 1 00:00:00 1970 From: LC Bruzenak Subject: Re: audit-1.7.16 released Date: Mon, 26 Oct 2009 09:46:33 -0500 Message-ID: <1256568393.3515.4.camel@lcb> References: <200910171155.43836.sgrubb@redhat.com> Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <200910171155.43836.sgrubb@redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb Cc: Linux Audit List-Id: linux-audit@redhat.com On Sat, 2009-10-17 at 11:55 -0400, Steve Grubb wrote: > Hi, > > I've just released a new version of the audit daemon. It can be downloaded > from http://people.redhat.com/sgrubb/audit. It will also be in rawhide > soon. The ChangeLog is: > > - If audisp-remote plugin has a queue at exit, use non-zero exit code > - In auditd, tell libev to stop processing a connection when idle timeout > - In auditd, tell libev to stop processing a connection when shutting down > > This release fixes a bug introduced in the 1.7.15 release. The main problem was > that the idle timeout was not telling libev to stop processing the associated > socket when it closed an idle connection. Subsequent reconnects would go into > an error state and libev would immediately close the new connection. This > update fixes that problem. I also applied a patch from trunk that checks the > queue size on exit of audisp-remote to decide if it was successful or not. > > Please let me know if you run across any problems with this release. > > -Steve Is there any indication that this event has happened being logged? The man page indicates it might be ("...before auditd complains"). Thx, LCB. -- LC (Lenny) Bruzenak lenny@magitekltd.com