Re: audit collection
On Mon, 2008-09-15 at 13:24 -0400, DJ Delorie wrote:
> Sep 15 11:48:14 comms audispd: queue is full - dropping event
>
> I assume this indicates the problem - sending isn't happening so the
> audispd queue fills.
Yes, this means nothing is getting across the network. Have you tried
running tcpdump on the client side? Or running gdb on the running
audisp-remote to see where it's stuck.
(gdb) where
#0 0x0000000000892590 in __read_nocancel () from /lib64/libc.so.6
#1 0x00007f25874db914 in main (argc=<value optimized out>, argv=<value
optimized out>)
at /usr/include/bits/unistd.h:45
I suppose I'd need to run the debug code to get a better analysis.
LCB.
--
LC (Lenny) Bruzenak
lenny(a)magitekltd.com