Re: audit-1.7.16 released

[Steve Grubb <sgrubb@redhat.com>]

On Monday 26 October 2009 10:46:33 am LC Bruzenak wrote:
> On Sat, 2009-10-17 at 11:55 -0400, Steve Grubb wrote:
> > I've just released a new version of the audit daemon. It can be
> > downloaded from http://people.redhat.com/sgrubb/audit. It will also be in
> > rawhide soon. The ChangeLog is:
> >
> > - If audisp-remote plugin has a queue at exit, use non-zero exit code
> > - In auditd, tell libev to stop processing a connection when idle timeout
> > - In auditd, tell libev to stop processing a connection when shutting
> > down
> >
> > This release fixes a bug introduced in the 1.7.15 release. The main
> > problem was that the idle timeout was not telling libev to stop
> > processing the associated socket when it closed an idle connection.
> > Subsequent reconnects would go into an error state and libev would
> > immediately close the new connection. This update fixes that problem. I
> > also applied a patch from trunk that checks the queue size on exit of
> > audisp-remote to decide if it was successful or not.
> >
> > Please let me know if you run across any problems with this release.
> 
> Is there any indication that this event has happened being logged?

This was a bugfix where libev was not being told that the connection was closed 
by the auditd code. The fix is right below the syslog message saying this 
happened.

-Steve