Auditd hangs hard

I have a test server on which, if left to its own devices, the audit daemon will lock up hard. The most obvious symptoms are: * An attempt to read /proc/<auditd pid>/ will hang * auditd cannot be killed with -9 * The logs are full of backlog exceeded messages. The system in question is doing some fairly severe system call auditing. The audit daemon is configured not to write to disk at all. Instead it uses a custom dispatcher which directly wraps the audit messages as a syslog message and sends it directly via UDP to a central host. The change which prompted this behaviour seems to be the installation of LSF analytics, which is quite exceptionally noisy from a syscall POV. The system is RHEL 4 x86_64 running: audit-1.0.15-3.EL4 kernel-smp-2.6.9-42.0.8.EL It's basically RHEL 4 U4 with auditd from U5. Any ideas what might be causing this, or how to debug? Thanks, Matt -- Matthew Booth, RHCA, RHCSS Red Hat, Global Professional Services M: +44 (0)7977 267231 GPG ID: D33C3490 GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490