* auditd hangs
@ 2016-05-17 8:49 Andrey Kulikov
2016-05-17 17:15 ` Richard Guy Briggs
0 siblings, 1 reply; 2+ messages in thread
From: Andrey Kulikov @ 2016-05-17 8:49 UTC (permalink / raw)
To: linux-audit
Hi everyone,
We have several thousands hosts running CentOS 7. Every day auditd stops
writing audit.log on 2-3 of them (different hosts every day). Here is
strace output:
# strace -p 17306
Process 17306 attached
epoll_wait(7, {}, 64, 59743) = 0
epoll_wait(7, {}, 64, 59743) = 0
epoll_wait(7, {}, 64, 59743) = 0
epoll_wait(7, {}, 64, 59743) = 0
epoll_wait(7, {}, 64, 59743) = 0
epoll_wait(7, {}, 64, 59743) = 0
epoll_wait(7, {}, 64, 59743) = 0
epoll_wait(7, 7fb4c3302be0, 64, 59743) = -1 EINTR (Interrupted system call)
--- SIGHUP {si_signo=SIGHUP, si_code=SI_USER, si_pid=2728, si_uid=0} ---
write(8, "\1\0\0\0\0\0\0\0", 8) = 8
rt_sigreturn() = -1 EINTR (Interrupted system call)
epoll_wait(7, {{EPOLLIN, {u32=8, u64=4294967304}}}, 64, 59743) = 1
read(8, "\1\0\0\0\0\0\0\0", 8) = 8
sendto(3, "\20\0\0\0\362\3\5\0\4\0\0\0\0\0\0\0", 16, 0,
{sa_family=AF_NETLINK,
pid=0, groups=00000000}, 12) = 16
poll([{fd=3, events=POLLIN}], 1, 500) = 1 ([{fd=3, revents=POLLIN}])
recvfrom(3,
"$\0\0\0\2\0\0\0\4\0\0\0\232C\0\0\0\0\0\0\20\0\0\0\362\3\5\0\4\0\0\0"...,
8988, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000},
[12]) = 36
recvfrom(3,
"$\0\0\0\2\0\0\0\4\0\0\0\232C\0\0\0\0\0\0\20\0\0\0\362\3\5\0\4\0\0\0"...,
8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000},
[12]) = 36
epoll_wait(7, {{EPOLLIN, {u32=3, u64=4294967299}}}, 64, 59743) = 1
recvfrom(3,
"N\0\0\0\362\3\0\0\4\0\0\0\232C\0\0\363\3\0\0\217C\0\0unconfin"..., 8988,
MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 80
mmap(NULL, 8392704, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK,
-1, 0) = 0x7fb4be5da000
mprotect(0x7fb4be5da000, 4096, PROT_NONE) = 0
clone(child_stack=0x7fb4bedd9eb0,
flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID,
parent_tidptr=0x7fb4bedda9d0, tls=0x7fb4bedda700,
child_tidptr=0x7fb4bedda9d0)
= 3014
epoll_wait(7,
... and line "epoll_wait(7," repeated infinitely.
auditd restart helps, but I thint this is a bug. What can be causes of
the problem?
Thanks for your help in advance!
--
Regards,
Andrey Kulikov.
^ permalink raw reply [flat|nested] 2+ messages in thread* Re: auditd hangs
2016-05-17 8:49 auditd hangs Andrey Kulikov
@ 2016-05-17 17:15 ` Richard Guy Briggs
0 siblings, 0 replies; 2+ messages in thread
From: Richard Guy Briggs @ 2016-05-17 17:15 UTC (permalink / raw)
To: Andrey Kulikov; +Cc: linux-audit
On 16/05/17, Andrey Kulikov wrote:
> Hi everyone,
>
> We have several thousands hosts running CentOS 7. Every day auditd
> stops writing audit.log on 2-3 of them (different hosts every day).
Without more information, I suspect it is this bug here:
https://bugzilla.redhat.com/show_bug.cgi?id=1253123
Is there any complaint in the syslog about auditd disappearing?
> Here is strace output:
>
> # strace -p 17306
> Process 17306 attached
> epoll_wait(7, {}, 64, 59743) = 0
> epoll_wait(7, {}, 64, 59743) = 0
> epoll_wait(7, {}, 64, 59743) = 0
> epoll_wait(7, {}, 64, 59743) = 0
> epoll_wait(7, {}, 64, 59743) = 0
> epoll_wait(7, {}, 64, 59743) = 0
> epoll_wait(7, {}, 64, 59743) = 0
> epoll_wait(7, 7fb4c3302be0, 64, 59743) = -1 EINTR (Interrupted system call)
> --- SIGHUP {si_signo=SIGHUP, si_code=SI_USER, si_pid=2728, si_uid=0} ---
> write(8, "\1\0\0\0\0\0\0\0", 8) = 8
> rt_sigreturn() = -1 EINTR (Interrupted system call)
> epoll_wait(7, {{EPOLLIN, {u32=8, u64=4294967304}}}, 64, 59743) = 1
> read(8, "\1\0\0\0\0\0\0\0", 8) = 8
> sendto(3, "\20\0\0\0\362\3\5\0\4\0\0\0\0\0\0\0", 16, 0,
> {sa_family=AF_NETLINK,
> pid=0, groups=00000000}, 12) = 16
> poll([{fd=3, events=POLLIN}], 1, 500) = 1 ([{fd=3, revents=POLLIN}])
> recvfrom(3,
> "$\0\0\0\2\0\0\0\4\0\0\0\232C\0\0\0\0\0\0\20\0\0\0\362\3\5\0\4\0\0\0"...,
> 8988, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000},
> [12]) = 36
> recvfrom(3,
> "$\0\0\0\2\0\0\0\4\0\0\0\232C\0\0\0\0\0\0\20\0\0\0\362\3\5\0\4\0\0\0"...,
> 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000},
> [12]) = 36
> epoll_wait(7, {{EPOLLIN, {u32=3, u64=4294967299}}}, 64, 59743) = 1
> recvfrom(3,
> "N\0\0\0\362\3\0\0\4\0\0\0\232C\0\0\363\3\0\0\217C\0\0unconfin"..., 8988,
> MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 80
> mmap(NULL, 8392704, PROT_READ|PROT_WRITE,
> MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK,
> -1, 0) = 0x7fb4be5da000
> mprotect(0x7fb4be5da000, 4096, PROT_NONE) = 0
> clone(child_stack=0x7fb4bedd9eb0,
> flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID,
> parent_tidptr=0x7fb4bedda9d0, tls=0x7fb4bedda700,
> child_tidptr=0x7fb4bedda9d0)
> = 3014
> epoll_wait(7,
>
> ... and line "epoll_wait(7," repeated infinitely.
>
> auditd restart helps, but I thint this is a bug. What can be causes
> of the problem?
>
> Thanks for your help in advance!
>
> --
> Regards,
> Andrey Kulikov.
>
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit
- RGB
--
Richard Guy Briggs <rgb@redhat.com>
Kernel Security Engineering, Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2016-05-17 17:15 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-05-17 8:49 auditd hangs Andrey Kulikov
2016-05-17 17:15 ` Richard Guy Briggs
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox