Re: Audit issues with Snare version 1.5 and RHEL 5.3 x86_64

Re: Audit issues with Snare version 1.5 and RHEL 5.3 x86_64

[Kevin Boyce]

[-- Attachment #1.1: Type: text/plain, Size: 677 bytes --]

I think the auditd package that ships with 5.3 has a bug.  Use one of
the newer versions available from

http://people.redhat.com/sgrubb/audit/index.html

On Mon, 2009-04-27 at 11:15 -1000, Dave Trepanier wrote:

> uditd audit.log files stops receiving log entries until the auditd
> service is stopped and restarted.  The logs entries re-start also
> after I run audit –f.  I have been thinking about updating auditd ,
> currently release 7.7.7-6, to a newer release.  The challenge is
> updating it without an internet connection.  The machine cannot be
> connected to the internet, so all program dependencies need to be
> installed manually.  Does anyone k

[-- Attachment #1.2: Type: text/html, Size: 1057 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: Audit issues with Snare version 1.5 and RHEL 5.3 x86_64

[Steve Grubb]

On Monday 27 April 2009 06:03:48 pm Kevin Boyce wrote:
> I think the auditd package that ships with 5.3 has a bug.

There was a memory leak when specifying the NOLOG format option that was fixed 
in a RHEL5 release last week. Look for audit-1.7.7-6.el5_3.2.rpm.

-Steve