When the NOLOG format is used replace_event_msg() doesn't change e->reply.message so the message located on the stack is left and later is free()'d in cleanup_event() resulting in the following: *** Error in `auditd': free(): invalid pointer: 0x800bef7c *** ======= Backtrace: ========= /lib/libc.so.6(+0x676ba)[0xb752b6ba] /lib/libc.so.6(+0x6e227)[0xb7532227] /lib/libc.so.6(+0x6e9e6)[0xb75329e6] auditd(+0x73df)[0x800a43df] auditd(+0x4975)[0x800a1975] auditd(+0x4a9c)[0x800a1a9c] auditd(main+0x931)[0x800a0c21] /lib/libc.so.6(__libc_start_main+0xf6)[0xb74dc1a6] auditd(+0x44c4)[0x800a14c4] ======= Memory map: ======== ... This patch changes the log format to RAW when NOLOG format is detected so that replace_event_msg() will replace e->reply.message with a message that can be free()'d by cleanup_event(). Signed-off-by: George McCollister <george.mccollister(a)gmail.com&gt; --- src/auditd-config.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/auditd-config.c b/src/auditd-config.c index 584f079..bc06b1c 100644 --- a/src/auditd-config.c +++ b/src/auditd-config.c @@ -839,6 +839,7 @@ static int log_format_parser(struct nv_pair *nv, int line, if (strcasecmp(nv->value, log_formats[i].name) == 0) { config->log_format = log_formats[i].option; if (config->log_format == LF_NOLOG) { + config->log_format = LF_RAW; audit_msg(LOG_WARNING, "The NOLOG option to log_format is deprecated. Please use the write_logs option."); if (config->write_logs != 0) -- 2.9.3