Red Hat Bugzilla – Bug 141314
standard audit configuration can causes silent system hangs and does not match documentation
Last modified: 2015-01-07 19:08:54 EST
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.5)
Description of problem:
The standard configuration for auditing can cause silent hangs of a
machine if the audit system encounters errors because it only goes
into suspend mode and produces no diagnostics to indicate that it has
This does not match the man page which states
"When auditd encounters an error while writing to a file, or if the
bin mode notify command fails, it enters error mode. The default
action is to log a message to the system log, and suspend the audit
Since a system that silently hangs is less than helpful for diagnostic
purposes it makes sense to ensure that auditing generates some diagnostic.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1.install a system
Expected Results: standard audit configuration should produce a
diagnostic message on error.
Created attachment 107614 [details]
patch against /etc/audit/audit.conf
Diff to standard /etc/audit/audit.conf to provide a diagnostic if the audit
daemon encounters an error.
applied to CVS for testing, Thanks
This bug is now fixed in laus-0.1-67RHEL3, which should be in
RHEL-3-U5, and which meanwhile can be downloaded from:
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.
I'm getting "silent system hangs" - reproduceable after about a week of
uptime. /sbin/auditd is the cause (killing this - providing a root shell
session is available to do so from - corrects the hang. Re-running re-
introduces the hang immediately.) Nothing is getting logged anywhere, no
matter how I set up the configuration files.
There should probably never be any situation allowed where something is
permitted to lock up a system without any message of any kind getting logged
anyplace - not even if the admin doesn't want the message logged.
I've got 40gigs free disc etc.