[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: auditd hanging the system...



On Wed, 15 Mar 2006 09:30:34 EST, Steve Grubb said:
> On Tuesday 14 March 2006 18:06, Valdis Kletnieks vt edu wrote:
> > Mar 14 18:02:09 turing-police kernel: [21744.040000] audit(0.000:267):
> > nargs=3 a0=4 a1=bfb7a4f8 a2=bfb7a4a0 Mar 14 18:02:10 turing-police last
> > message repeated 16 times
> 
> I think I found the problem with time being 0.000. I'm still looking for the 
> reason why so many of these were spit out.

Following up on this one...

1) The msg flood problem is still present in 2.6.16-mm1.

2) Your patch to set ctx->ctime isn't in 2.6.12-mm1, and does fix the 0.000 time
problem, but doesn't fix the msg flood problem.

3) It *does* seem related to the kernel throwing an AVC message - I'm only
using auditd to catch avc's at the moment....

Attachment: pgpkzZXVbOGbo.pgp
Description: PGP signature


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]