[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: auditd hanging the system...

On Tue, 14 Mar 2006 17:37:48 EST, Steve Grubb said:

> Hmm. I wonder who's guilty. Its either kernel or userspace. One way to cut the 
> problem in half is to let messages go to syslog, but still load the audit 
> rules. I'd alter the initscript to not start it.

I've managed to trigger it every few hours (3 times since I got to work today,
and several times yesterday), so I'll give that a try.

> I wonder if this has anything to do with the mutex conversion...or something 
> entirely different. I also notice that you have some things out of order. 
> events 267 & 272 get intertwined.

Yes, if it hadn't intertwined them, we'd just have gotten about 3,000 copies of
event 267, and then 3,000 or so of 272.  But I suspect the intertwining and the
duplicating are both symptoms of the same root fault....

And the "time->Wed Dec 31 19:00:00 1969" parts are odd, too, considering that
the machine in question is NTP-synced and has a sane clock....

Attachment: pgpRxMReaZOCl.pgp
Description: PGP signature

[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]