Re: Has anyone else seen memory Problems with audisp-remote?
On Wednesday, October 27, 2010 10:23:55 pm Jim Richard wrote:
* Does anyone have any other ideas on what I might do to get
to the
bottom of this?
There is indeed a leak in the remote logging and bz 649952 was opened for it.
I also have a separate issue, that I'm curious about. Under
RedHat EL 5.5
there doesn't seem to be any limitations on the support for audisp-remote,
but I just noticed in the release notes for RedHat EL 6 Beta, this
component is flagged as a Technology Preview in EL 6. Does anyone know the
reason for the change in status?
It is Technology Preview. Its not quite ready for prime time as it does not yet have a
store and forward model so that events do not get lost. The transport is not encrypted
because we do not enable the gssapi support. This is because the kerberos libraries
are in /usr and audit is in /sbin. So, if you have a NFS based /usr, auditd is broken.
It should have never left "Tech Preview" status.
Beyond this query I also plan to open a support incident with RedHat,
but I
thought that by using feedback from this group I might be in a better
position to provide support with useful information to aid in problem
diagnosis.
If you do, you can reference the above bugzilla number.
-Steve