On Wednesday 29 June 2005 03:03, David Woodhouse wrote:
Show SysRq-T, SysRq-P output.
I don't have serial cable or spare computer with serial port.
However, I did track the problem down somewhat. It turns out that:
auditctl -a entry,always -S socketcall
is what triggers the hang. I remember auditing socket calls when working on
ausearch interpretation code. So I booted into old kernels.
.61 runs, but starts heavy disk activity.
.62 runs, but reports backlog overflow to console
.63 hangs.
The changelog for .63 says:
- Wait for backlog to drain where possible
So, my guess is that there is something in the draining of the backlog that
causes this problem. The audit logs from .62 shows that recvfrom() for auditd
is being audited over and over.
I also wonder if this is related to the problem Debbie & Denise were
reporting? It seems similar - system hung, no visible indicators that it hit
the backlog draining.
-Steve