Bug 1028635
Summary: | audisp-remote will not reconnect to remote server after a transient "critical" network error | ||
---|---|---|---|
Product: | Red Hat Enterprise Linux 6 | Reporter: | John Trowbridge <jtrowbri> |
Component: | audit | Assignee: | Steve Grubb <sgrubb> |
Status: | CLOSED ERRATA | QA Contact: | Patrik Kis <pkis> |
Severity: | high | Docs Contact: | |
Priority: | high | ||
Version: | 6.4 | CC: | jkurik, jtrowbri, ksrot, omoris, pkis, qe-baseos-security, sforsber, sgrubb, vanhoof |
Target Milestone: | rc | Keywords: | ZStream |
Target Release: | --- | ||
Hardware: | Unspecified | ||
OS: | Unspecified | ||
Whiteboard: | |||
Fixed In Version: | audit-2.2-4.el6 | Doc Type: | Bug Fix |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2014-10-14 07:14:35 UTC | Type: | Bug |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 1044628 | ||
Bug Blocks: | 1042734 |
Description
John Trowbridge
2013-11-08 22:28:51 UTC
There is an upstream fix for this. Simple fix to back port just that patch. The main patches that fixes this is 867 & 871. https://fedorahosted.org/audit/changeset/867 However, that also depended on 865, 864, 863, and 860 because the management of plugins was not working correctly. Meaning that if you changed a setting in audisp-remote.conf, you could not do, "service auditd reload" and have sighup propogate to the remote plugin. Could you please share the details about this bug and its reproducer? It is not clear from the description - what is meant by a 'transient "critical" network error.'? audit-2.2-3.el6 was built with just patch 867 & 871 applied. Thanks for the investigation. I can see that I need to modify the patch a bit. I will provide an updated build. Fixed in upstream commit 895. audit-2.2-4.el6 was built to resolve this problem. It adds upstream commit 895 to the patch. When updating to the new version, please make sure that the /etc/audisp/audisp-remote.conf configuration file is updated too. The default value of "remote_ending_action" has changed from: remote_ending_action = suspend to remote_ending_action = reconnect This change is an important part if the fix. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2014-1515.html |