From mboxrd@z Thu Jan 1 00:00:00 1970 From: Paul Moore Subject: Re: v3.19-rc2: crashes during boot (syslog-ng, rpcbind ...) Date: Tue, 30 Dec 2014 09:11:32 -0500 Message-ID: <5490032.bFDrnJqxyv@sifl> References: <54A17C49.5080102@gmx.de> <4182091.odzUCAWhED@sifl> <54A1B724.8070106@gmx.de> Mime-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: QUOTED-PRINTABLE Return-path: In-Reply-To: <54A1B724.8070106@gmx.de> Sender: linux-kernel-owner@vger.kernel.org To: Toralf =?ISO-8859-1?Q?F=F6rster?= Cc: linux Kernel , linux-audit@redhat.com List-Id: linux-audit@redhat.com On Monday, December 29, 2014 09:18:44 PM Toralf F=F6rster wrote: > On 12/29/2014 08:41 PM, Paul Moore wrote: > > To help verify that I'm heading down the right path, could you shar= e your > > audit configuration as well? If that's not possible, can you at le= ast > > confirm that you using a few audit directory watches? >=20 > Well, it is just a victim system for trinity - but I did not configur= ed > auditd in a special manner - so it is just the plain default configur= ation > of Gentoo: Okay, thanks for the information; the file related syscall watches are = likely=20 what triggered the problem code. Until I've got the fix sorted out, re= moving=20 the syscall watches or just disabling auditd from starting at boot shou= ld=20 workaround the problem. --=20 paul moore www.paul-moore.com