Re: auditd hanging the system...
On Wed, 15 Mar 2006 09:30:34 EST, Steve Grubb said:
On Tuesday 14 March 2006 18:06, Valdis.Kletnieks(a)vt.edu wrote:
> Mar 14 18:02:09 turing-police kernel: [21744.040000] audit(0.000:267):
> nargs=3 a0=4 a1=bfb7a4f8 a2=bfb7a4a0 Mar 14 18:02:10 turing-police last
> message repeated 16 times
I think I found the problem with time being 0.000. I'm still looking for the
reason why so many of these were spit out.
Following up on this one...
1) The msg flood problem is still present in 2.6.16-mm1.
2) Your patch to set ctx->ctime isn't in 2.6.12-mm1, and does fix the 0.000 time
problem, but doesn't fix the msg flood problem.
3) It *does* seem related to the kernel throwing an AVC message - I'm only
using auditd to catch avc's at the moment....
Attachments:
- attachment.sig (application/pgp-signature — 228 bytes)