From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: audit-1.7.16 released Date: Fri, 30 Oct 2009 10:56:20 -0400 Message-ID: <200910301056.20700.sgrubb@redhat.com> References: <200910171155.43836.sgrubb@redhat.com> <1256568393.3515.4.camel@lcb> Mime-Version: 1.0 Content-Type: Text/Plain; charset="iso-8859-15" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1256568393.3515.4.camel@lcb> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: LC Bruzenak Cc: Linux Audit List-Id: linux-audit@redhat.com On Monday 26 October 2009 10:46:33 am LC Bruzenak wrote: > On Sat, 2009-10-17 at 11:55 -0400, Steve Grubb wrote: > > I've just released a new version of the audit daemon. It can be > > downloaded from http://people.redhat.com/sgrubb/audit. It will also be in > > rawhide soon. The ChangeLog is: > > > > - If audisp-remote plugin has a queue at exit, use non-zero exit code > > - In auditd, tell libev to stop processing a connection when idle timeout > > - In auditd, tell libev to stop processing a connection when shutting > > down > > > > This release fixes a bug introduced in the 1.7.15 release. The main > > problem was that the idle timeout was not telling libev to stop > > processing the associated socket when it closed an idle connection. > > Subsequent reconnects would go into an error state and libev would > > immediately close the new connection. This update fixes that problem. I > > also applied a patch from trunk that checks the queue size on exit of > > audisp-remote to decide if it was successful or not. > > > > Please let me know if you run across any problems with this release. > > Is there any indication that this event has happened being logged? This was a bugfix where libev was not being told that the connection was closed by the auditd code. The fix is right below the syslog message saying this happened. -Steve