Issues with auditd kernel panic and nfs mounts

[Vaughn, Chad M]

Has anybody had any issues with auditd causing a panic upon restart or shutdown?  We are using Redhat 5.4 with base auditd. We have diskless clients, thus the /etc and /var are being served from an NFS server. The following rules cause the system to panic when we try to /etc/init.d/auditd restart or just shut the system down.   We have hundreds of other Redhat clients with local disks and have not had any problems with these rules until we tried diskless and NFS.

We can comment out the rules listed below and then no problem, but we want to watch /etc and /var. I assume it's something to do with NFS but can't track it down.  Any ideas? Thanks.

Example of rules entries that are expected to be causing issues:

-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=100 -F auid!=4294967295 -F dir=/etc -k sro
-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=100 -F auid!=4294967295 -F dir=/var -k sro

-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=100 -F auid!=4294967295 -F dir=/etc -k sro
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=100 -F auid!=4294967295 -F dir=/var -k sro


-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=100 -F auid!=4294967295 -F dir=/etc -k sro
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=100 -F auid!=4294967295 -F dir=/var -k sro


--
Regards,
Chad Vaughn
chad.m.vaughn at lmco.com<mailto:chad.m.vaughn at lmco.com>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20120713/76ca8092/attachment.htm>