- First Post
- Replies
- Stats
-
Go to
- ----- 2024 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2023 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2022 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2021 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2020 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2019 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2018 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2017 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2016 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2015 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2014 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2013 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2012 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2011 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2010 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2009 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2008 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2007 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2006 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2005 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2004 -----
- December
- November
- October
- September
- August
My platform is running RHEL5 (beta) with SNARE running as a dispatcher
I am seeing many of these logs in my /var/log/messages
Mar 9 13:59:02 vette auditd[23098]: dispatch err (pipe full) event lost
Mar 9 13:59:02 vette last message repeated 22 times
Mar 9 13:59:02 vette auditd[23098]: dispatch error reporting limit
reached - ending report notification.
Anyone know what is causing these:
Ameel Kamboh
MCS AS5200 Security and Media Services
Phone: 972.685.4922 (esn 445-4922)
Mobile: 978-590-2280
SIP: akamboh(a)techtrial.com
email: akamboh(a)nortel.com
Attachments:
- attachment.html (text/html — 1.9 KB)
On Friday 09 March 2007 15:01, Ameel Kamboh wrote:
Anyone know what is causing these:
That program is not pulling the events from the audit daemon fast enough.
-Steve
Does this mean the dispatcher is now turned of or I just loose those
events.
Currently I am not seeing any events in SNARE and trying to trouble
shoot where the issue is.
Any help will be great.
Thanks.
Ameel Kamboh
MCS AS5200 Security and Media Services
Phone: 972.685.4922 (esn 445-4922)
Mobile: 978-590-2280
SIP: akamboh(a)techtrial.com
email: akamboh(a)nortel.com
-----Original Message-----
From: Steve Grubb [mailto:sgrubb@redhat.com]
Sent: Friday, March 09, 2007 2:19 PM
To: linux-audit(a)redhat.com
Cc: Kamboh, Ameel (RICH1:B670)
Subject: Re: Audit pipe full
On Friday 09 March 2007 15:01, Ameel Kamboh wrote:
Anyone know what is causing these:
That program is not pulling the events from the audit daemon fast
enough.
-Steve
On Friday 09 March 2007 15:20, Ameel Kamboh wrote:
Does this mean the dispatcher is now turned of or I just loose those
events.
No. You need to look in /etc/audit/auditd.conf to see what your disp_qos
setting is. The options are lossy and blocking.
Currently I am not seeing any events in SNARE and trying to trouble
shoot where the issue is.
There is a sample program: /usr/share/doc/audit-1.3.1/skeleton.c that is an
event dispatcher, too. You can build and install it. It sends events to
syslog. If that works then the problem is the snare piece. If that program
fails, let me know.
-Steve
6497
days inactive
6497
days old
linux-audit@lists.linux-audit.osci.io
3 comments
2 participants
tags (0)
participants (2)
-
Ameel Kamboh -
Steve Grubb