From: Steve Grubb <sgrubb@redhat.com>
To: linux-audit@redhat.com
Subject: Re: Problem with auditd/SnareLinux on RHEL 5.3 - auditd glomming memory
Date: Sat, 21 Feb 2009 08:07:22 -0500 [thread overview]
Message-ID: <200902210807.23323.sgrubb@redhat.com> (raw)
In-Reply-To: <E16729F04227D342863BEEB34D4A3C5C85E3D3@EMAIL02.pnl.gov>
On Thursday 19 February 2009 04:30:10 pm Smith, Gary R wrote:
> When the setting for the output log format is set to "NOLOG" (log_format
> = NOLOG in auditd.conf) it appears that audit events are getting stacked
> up in the internal message queue (audit_reply_list) and are not removed
> from the stack after being written to the audit dispatcher daemon. The
> result is the stack grows without end.
>
> I have the following potential fix for audit version 1.7.11:
OK, I had a chance to look into this problem. The big clue was that its only
happening when NOLOG is given. The patch that was sent does fix the problem,
but it doesn't allow reconfigure (sighup) and on-demand log rotation
(sigusr1) to work either. What I believe is the correct fix was put into svn
as commit 252.
https://fedorahosted.org/audit/changeset/252
Thanks for the troubleshooting.
-Steve
prev parent reply other threads:[~2009-02-21 13:07 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-02-04 22:15 Problem with auditd/SnareLinux on RHEL 5.3 - auditd glomming memory Smith, Gary R
2009-02-05 2:14 ` Lucas C. Villa Real
2009-02-05 16:32 ` Steve Grubb
2009-02-19 21:30 ` Smith, Gary R
2009-02-19 21:54 ` Steve Grubb
2009-02-21 13:07 ` Steve Grubb [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200902210807.23323.sgrubb@redhat.com \
--to=sgrubb@redhat.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox