Red Hat Bugzilla – Bug 136657
CROND messages LAuS error when audit daemon not running
Last modified: 2007-11-30 17:07:04 EST
Description of problem: Version-Release number of selected component (if applicable): How reproducible: just present Steps to Reproduce: 1. 2. 3. Actual results: entriles in the log files saying: Oct 20 00:01:00 lxb1428 CROND[25039]: LAuS error - do_command.c:226 - laus_attach: (19) laus_attach: No such device Oct 20 00:25:00 lxb1428 CROND[25041]: LAuS error - do_command.c:226 - laus_attach: (19) laus_attach: No such device Oct 20 00:30:00 lxb1428 CROND[25058]: LAuS error - do_command.c:226 - laus_attach: (19) laus_attach: No such device Oct 20 00:40:00 lxb1428 CROND[26731]: LAuS error - do_command.c:226 - laus_attach: (19) laus_attach: No such device Oct 20 01:01:00 lxb1428 CROND[20140]: LAuS error - do_command.c:226 - laus_attach: (19) laus_attach: No such device Oct 20 02:01:00 lxb1428 CROND[4187]: LAuS error - do_command.c:226 - laus_attach: (19) laus_attach: No such device Oct 20 03:01:00 lxb1428 CROND[4191]: LAuS error - do_command.c:226 - laus_attach: (19) laus_attach: No such device Oct 20 03:30:00 lxb1428 CROND[4194]: LAuS error - do_command.c:226 - laus_attach: (19) laus_attach: No such device ORPHAN (no passwd entry) Oct 20 04:01:00 lxb1428 CROND[4259]: LAuS error - do_command.c:226 - laus_attach: (19) laus_attach: No such device Oct 20 04:02:00 lxb1428 CROND[4261]: LAuS error - do_command.c:226 - laus_attach: (19) laus_attach: No such device Oct 20 05:00:00 lxb1428 CROND[28166]: LAuS error - do_command.c:226 - laus_attach: (19) laus_attach: No such device Oct 20 05:01:00 lxb1428 CROND[28446]: LAuS error - do_command.c:226 - laus_attach: (19) laus_attach: No such device Oct 20 06:01:00 lxb1428 CROND[10941]: LAuS error - do_command.c:226 - laus_attach: (19) laus_a Expected results: Additional info:
Quoting from bug 131860: The underlying issue is that the user space tools assume that if they can open the audit device then auditing is enabled. There is no provision for asking the audit device if there is an audit daemon registered. Given this state of affairs, the best option is to make it impossible to open the audit device if auditing is to be disabled. Assuming you want to run without auditd, try this: add this line to /etc/modules.conf: alias char-major-10-224 off then shut down crond and atd and make sure the auditd is not running and will not run. This should drop the use count on the audit kernel module to 0 so that your can rmmod the module. Once you have you can restarted crond and atd and they should henceforth run without those messages in the cron and at logs.
*** This bug has been marked as a duplicate of 131860 ***
Changed to 'CLOSED' state since 'RESOLVED' has been deprecated.