| Summary: | vmtoolsd freezes a filesystem and is not able to thaw it. | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Cesar Sanchez <csanchez> |
| Component: | audit | Assignee: | Steve Grubb <sgrubb> |
| Status: | CLOSED NOTABUG | QA Contact: | BaseOS QE Security Team <qe-baseos-security> |
| Severity: | high | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 6.9 | CC: | csanchez, pmoore |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2016-03-21 12:51:57 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
|
Description
Cesar Sanchez
2016-03-18 18:09:05 UTC
By any chance is selinux enabled? If so, you may need to relabel the system. (In reply to Steve Grubb from comment #1) > By any chance is selinux enabled? If so, you may need to relabel the system. Thanks Steve. No, we've disabled SELINUX as part of our bootstrapping. Just FYI, This is also happening when using a docker host VM (using RHEL7) with the devicemapper driver using loop mounted sparse files which is a more generic scenario. Thanks, Do you have any audit rules loaded? If so, maybe do a key report aureport --start today --key --summary If not, then try aureport --start today --event --summary Auditd eating CPU means you are getting a lot of events. You need to find the source of the events so that you can adjust rules or something. I think the audit backlog and CPU issues are the effect of the frozen filesystem as stated in: https://access.redhat.com/solutions/473223 Probably You could re-assign this BZ to the correct product compoinent if it's the case? Disabling the vmtoolsd solves the issue but at a higher cost at the long term. Can be this only a VMware bug then? > Can be this only a VMware bug then?
Perhaps. Frozen file system would probably cause one thread of the audit system to stop which blocks the other that reads the backlog. When that overflows then syscalls get put on a wait queue.
You mention that there is a flood of audit messages, can you provide an example of the audit messages you are seeing in this flood? (In reply to Paul Moore from comment #8) > You mention that there is a flood of audit messages, can you provide an > example of the audit messages you are seeing in this flood? Not for now. I'll update the BZ when I setup a test environment again and I reproduce the issue. See the RH KB article below, it appears to be a case of VMware freezing the filesystem and failing to unfreeze it later. * https://access.redhat.com/solutions/1551943 (In reply to Paul Moore from comment #10) > See the RH KB article below, it appears to be a case of VMware freezing the > filesystem and failing to unfreeze it later. > > * https://access.redhat.com/solutions/1551943 Thanks for your help Paul, that explains it in detail. I'll contact VMWare for a solution. -Cesar Cesar, I'm going to close this as CANTFIX since this is a VMWare issue, if this turns out not to be the case feel free to reopen this case. |