Bug 141314
| Summary: | standard audit configuration can causes silent system hangs and does not match documentation | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 3 | Reporter: | Martin Poole <mpoole> | ||||
| Component: | laus | Assignee: | Jason Vas Dias <jvdias> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Jay Turner <jturner> | ||||
| Severity: | medium | Docs Contact: | |||||
| Priority: | medium | ||||||
| Version: | 3.0 | CC: | srevivo | ||||
| Target Milestone: | --- | ||||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2005-05-20 03:25:53 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
Created attachment 107614 [details]
patch against /etc/audit/audit.conf
Diff to standard /etc/audit/audit.conf to provide a diagnostic if the audit
daemon encounters an error.
applied to CVS for testing, Thanks This bug is now fixed in laus-0.1-67RHEL3, which should be in RHEL-3-U5, and which meanwhile can be downloaded from: http://people.redhat.com/~jvdias/laus/ An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHBA-2005-219.html I'm getting "silent system hangs" - reproduceable after about a week of uptime. /sbin/auditd is the cause (killing this - providing a root shell session is available to do so from - corrects the hang. Re-running re- introduces the hang immediately.) Nothing is getting logged anywhere, no matter how I set up the configuration files. There should probably never be any situation allowed where something is permitted to lock up a system without any message of any kind getting logged anyplace - not even if the admin doesn't want the message logged. I've got 40gigs free disc etc. |
From Bugzilla Helper: User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0 Description of problem: The standard configuration for auditing can cause silent hangs of a machine if the audit system encounters errors because it only goes into suspend mode and produces no diagnostics to indicate that it has done so. This does not match the man page which states "When auditd encounters an error while writing to a file, or if the bin mode notify command fails, it enters error mode. The default action is to log a message to the system log, and suspend the audit daemon." Since a system that silently hangs is less than helpful for diagnostic purposes it makes sense to ensure that auditing generates some diagnostic. Version-Release number of selected component (if applicable): laus-0.1-65RHEL3 How reproducible: Always Steps to Reproduce: 1.install a system 2. 3. Expected Results: standard audit configuration should produce a diagnostic message on error. Additional info: