Hello.<div><br></div><div>Did anybody ever experience kernel oopses and even kernel crashes (after a while), by just restarting repeatedly the auditd daemon?</div><div><br></div><div>I ask this because i had this problem on Dell R610 servers running Gentoo Linux kernels gentoo-sources-3.0.6 and gentoo-sources-2.6.37-r4 (see this bug: <a href="https://bugs.gentoo.org/show_bug.cgi?id=389405">https://bugs.gentoo.org/show_bug.cgi?id=389405</a> ).</div>
<div><br></div><div>The kernels are nothing special, just the vanilla 2.6.37 and 3.0.6 with a few gentoo patches (see <a href="https://lkml.org/lkml/2011/11/28/330">https://lkml.org/lkml/2011/11/28/330</a> ).</div><div><br>
</div><div>The auditd version is 2.1.3 (latest). The audit.rules file contains basically the following rules:</div><div><br></div><div>-D</div><div>-w /etc -p wa -k etc-directory</div><div>[snip: same for /sbin, /bin, /usr/sbin, /usr/bin]</div>
<div>-a exit,never -F dir=/lib/rc -k skip-lib-rc</div><div>-w /lib -p wa -k lib-directory</div><div>-w /usr/lib -p wa -k usr-lib-directory</div><div>-a exit,never -F arch=b32 -S read [snip: -S for write,open,fstat,mmap etc.] -k excluded-syscalls</div>
<div>-b 8192</div><div><br></div><div>The bug seems to be somewhere in the fsnotify kernel part, however Gentoo kernel devs and ppl on lkml did not seem too interested, so.. did anybody notice a similar behaviour? Or better yet, is anybody willing to run on one of your servers this simple test: start the minimum server services, use a similar audit.rules configuration, then start auditd and run in a shell the following one-liner:</div>
<div><br></div><div>while :; do /etc/init.d/auditd stop ; sleep 5 ; /etc/init.d/auditd start ; sleep 5 ; done</div><div><br></div><div>This was enough to oops and crash the kernel in less than one hour on the servers where i did the tests. If any similar behavior happens, i&#39;d be very interested to know the the kernel version and distro.</div>
<div><br></div><div>Thank you for your time.</div><div><br></div>