Re: peculiar disappearance of most audit rules

I have done this and this morning during 'mlocate' treewalking some of the usual paths disappeared; I verified the inos and the 'inotify' output and no inos changed nor any of the watched directories changed. Since the list of directories that *do not* disappear is usually: LIST_RULES: exit,always dir=/bin (0x4) perm=wa key=pkg-s LIST_RULES: exit,always dir=/etc (0x4) perm=wa key=pkg-s LIST_RULES: exit,always dir=/lib (0x4) perm=wa key=pkg-s LIST_RULES: exit,always dir=/usr (0x4) perm=wa key=pkg-s LIST_RULES: exit,always dir=/fs/sozan/loc (0xd) perm=wa key=pkg-l LIST_RULES: exit,always dir=/fs/sozan/com (0xd) perm=wa key=pkg-l and those that disappear tend to be far less frequently used directories like '/boot', '/opt', '/lib32'. Rereading this: it appears that I misread earlier: this says "inode", not "inum". Also it says "inode disappears", which is not necessarily always because the on-disk inode is deleted. Thus I have come up with a potential explanation: * The 'audit' module does not identify the watched file and directory by (device,ino) but by a pointer to an inode table entry, a bit like a filesystem module would. * During treewalks a lot of inodes get cached in the in-memory inode table. * This creates pressure on the inode tables and thus the least used (in some sense) inodes get evicted, and this includes those for the "disappearing directories". * When these least used inodes are evicted the 'audit' module sees it as if it was a removal of the inode. If the above is the right explanation it is a pretty big deal, because it means that a way to disable many/most 'audit' watches on files is to create and access a lot of inodes, which is pretty easy to do.