Loulwa Salem wrote: [Tue Jun 21 2005, 07:58:28PM EDT]
I am on an SMP x86_64 platform (kernel .65)
I tried the 0.9.11 audit ... and it hung (waited on it for 7.5 minutes
but I was able to do ctrl-z to stop the test) ... however I believe the
run left the system in an unstable state considering it wouldn't respond
to a reboot command, and had to be force rebooted anyway.
I have a little more info on the long pathname hang that Loulwa found.
I was able to reproduce it several times on a 2 CPU x86_64 box this
afternoon. I'm running with the 0.70 kernel and the 0.9.13 tools.
It doesn't seem to matter whether or not the audit subsystem is
enabled, or whether auditd is running.
I get the same ps output:
root 2536 6 0 17:14 ? 00:00:00 [kauditd]
root 2719 2580 0 17:15 pts/0 00:00:00 /bin/bash /etc/init.d/auditd
+restart
root 2727 2719 99 17:15 pts/0 00:00:43 /sbin/auditctl -D
root 2728 7 22 17:15 ? 00:00:10 [audit_list_rule]
On shutdown, the system gets stuck on 'Stopping pcmcia'. At one point
it provided a little more info:
Stopping pcmcia: warning: many lost ticks.
Your time source seems to be instable or some driver is hogging interupts
rip __do_softirq+0x4d/0xd0
I'm attaching sysrq -t output and straces of auditctl and auditd.
There wasn't any info available for sysrq -p. Note that the sysrq -t
output is actually from the 0.68 kernel. The output I got using the
0.70 kernel wasn't complete for auditctl.
Hope this helps,
Amy