From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: audit_get_reply() returns EBADE Date: Mon, 3 Mar 2008 16:04:46 -0500 Message-ID: <200803031604.46111.sgrubb@redhat.com> References: <47CBE074.9010706@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Return-path: Received: from vpn-15-121.rdu.redhat.com (vpn-15-121.rdu.redhat.com [10.11.15.121]) by mail.boston.redhat.com (8.13.1/8.13.1) with ESMTP id m23L5XUe010167 for ; Mon, 3 Mar 2008 16:05:34 -0500 In-Reply-To: <47CBE074.9010706@redhat.com> Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Monday 03 March 2008 06:26:44 Matthew Booth wrote: > A few times now I've seen audit_get_reply() return EBADE (Invalid > exchange). This coincides with a particular job which results in an > output rate of about 5.5k records/sec. The system remains responsive, > and it always fixes itself when the rate comes back down again. > > What exactly does EBADE mean in this context? No idea. A quick grep in the kernel source shows it only comes from a couple places. bluetooth, sparc, and dlm are the main places. none of which seem to be netlink related. > I assume I'm dropping audit messages from the kernel while this is going on. > Is there any way I can determine how many? I think you'd have to patch the kernel to prove that to yourself. > Is there any way to tune things to survive this temporary stress event? I can't see how you are getting this in the first place. Have you grepped around to see where its coming from? -Steve