Description of problem: audbin isn't compiled with -D_FILE_OFFSET_BITS=64 so it fails with EFBIG if opening a file >= 2-GiB (for concatenation. this may the case also for auditd in the bugzilla 125726 that somebody else reported and that was closed without mention of what the resolution was) Version-Release number of selected component (if applicable): laus-0.1-70RHEL3 How reproducible: use audbin -C -a as your notify command in audit.conf and generate enough audit data (excercise for the reader--or, in our case, our users) to cause serious binmode log churn (before logrotate cleans up) Steps to Reproduce: 1. as described above 2. 3. Actual results: notify command fails Expected results: audbin appends to file without dying Additional info: see attached log file indicating problem
Looks like an easy fix.
laus-0.1-76RHEL3 has been built with what I believe to be the fix.
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHBA-2007-0459.html