From mboxrd@z Thu Jan  1 00:00:00 1970
From: Steve Grubb <sgrubb@redhat.com>
Subject: Re: Problem with auditd/SnareLinux on RHEL 5.3 - auditd glomming
	memory
Date: Thu, 19 Feb 2009 16:54:40 -0500
Message-ID: <200902191654.40562.sgrubb@redhat.com>
References: <E16729F04227D342863BEEB34D4A3C5C761722@EMAIL02.pnl.gov>
	<200902051132.52225.sgrubb@redhat.com>
	<E16729F04227D342863BEEB34D4A3C5C85E3D3@EMAIL02.pnl.gov>
Mime-Version: 1.0
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <E16729F04227D342863BEEB34D4A3C5C85E3D3@EMAIL02.pnl.gov>
Content-Disposition: inline
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On Thursday 19 February 2009 04:30:10 pm Smith, Gary R wrote:
> When the setting for the output log format is set to "NOLOG" (log_format
> = NOLOG in auditd.conf) it appears that audit events are getting stacked
> up in the internal message queue (audit_reply_list) and are not removed
> from the stack after being written to the audit dispatcher daemon. The
> result is the stack grows without end.
>
> I have the following potential fix for audit version 1.7.11:

This looks like a really good hint at what's going on. I'll look into this 
deeper and either apply this patch or address the same problem another way in 
the next release.

Thanks,
-Steve