Bug 830780 - resume action from initscript is no longer supported
resume action from initscript is no longer supported
Status: CLOSED CURRENTRELEASE
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: audit (Show other bugs)
7.0
Unspecified Unspecified
medium Severity medium
: beta
: ---
Assigned To: Steve Grubb
Ondrej Moriš
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2012-06-11 08:02 EDT by Ondrej Moriš
Modified: 2014-06-13 06:21 EDT (History)
0 users

See Also:
Fixed In Version: audit-2.3-1
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 916611 (view as bug list)
Environment:
Last Closed: 2014-06-13 06:21:59 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Ondrej Moriš 2012-06-11 08:02:20 EDT
Description of problem:

In RHEL7 resume action is no longer supported for audit - or, better said, it is not possible to call 'service auditd resume' in order to wake up auditd after suspend. I am aware of the fact that it is possible to send a signal to resume suspended auditd, should it be the only way? Let's discuss it.

Version-Release number of selected component (if applicable):

audit-2.2.1-1.el7.x86_64

How reproducible:

100%

Steps to Reproduce:

1. set e.g. low disk action to "suspend"
2. fill the audit partition to triggrer suspending
3. find a way how to resume auditd :-) 
  
Actual results:

'service auditd resume' - action resume is not supported

Expected results:

e.g. wrap resume action into 'auditd-resume' call or something like that

Additional info:

I consider sending resume signal (SIGUSR2) directly by using 'kill' to be acceptable solution.
Comment 3 Steve Grubb 2013-04-17 08:49:05 EDT
Fixed in upstream commit 777.
Comment 4 Ondrej Moriš 2013-08-19 18:13:37 EDT
Successfully verified with audit-2.3.1-2.el7.

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: TEST PROTOCOL
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: [   LOG    ] :: Package       : unknown
:: [   LOG    ] :: Installed:    : unknown is not installed!
:: [   LOG    ] :: Test started  : 2013-08-19 18:07:52 EDT
:: [   LOG    ] :: Test finished : 2013-08-19 18:08:22 EDT
:: [   LOG    ] :: Test name     : /CoreOS/audit/Sanity/low-disk-space-default-warning-suspend-resume
:: [   LOG    ] :: Distro:       : Red Hat Enterprise Linux Server release 7.0 Beta (Maipo)
:: [   LOG    ] :: Hostname      : ibm-x3655-01.ovirt.rhts.eng.bos.redhat.com
:: [   LOG    ] :: Architecture  : x86_64

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: Test description
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

PURPOSE of /CoreOS/audit/Sanity/low-disk-space-default-warning-suspend-resume
Description: Test default actions on low disk space for audit.log partition: 
1) warning, 
2) suspend, 
3) resume 
See RHEL 5.5 errata for details.
Author: Eduard Benes <ebenes@redhat.com>

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: Setup
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: [   PASS   ] :: Checking for the presence of audit rpm 
:: [   LOG    ] :: Package versions:
:: [   LOG    ] ::   audit-2.3.1-2.el7.x86_64
:: [   PASS   ] :: Running 'dd if=/dev/zero of=/tmp/var-log-audit.img bs=1M count=100' (Expected 0, got 0)
:: [   PASS   ] :: Running 'mkfs.ext3 -F /tmp/var-log-audit.img' (Expected 0, got 0)
:: [   PASS   ] :: Running 'mount -o loop /tmp/var-log-audit.img /var/log/audit' (Expected 0, got 0)
:: [   PASS   ] :: Running 'mount | grep audit' (Expected 0, got 0)
:: [   PASS   ] :: Running 'touch /var/log/audit/audit.log' (Expected 0, got 0)
:: [   PASS   ] :: Running 'chmod 0600 /var/log/audit/audit.log' (Expected 0, got 0)
:: [   PASS   ] :: Running 'restorecon -Rv /var/log/audit /var/log/audit/audit.log' (Expected 0, got 0)
:: [   PASS   ] :: Running '/sbin/service auditd stop' (Expected 0, got 0)
:: [   PASS   ] :: Running '/sbin/service auditd start' (Expected 0, got 0)
:: [   LOG    ] :: Restarted auditd with new log file on a fake disk
:: [   PASS   ] :: Running 'tail /var/log/audit/audit.log | grep SETUP_MSG-audit-log-test-msg' (Expected 0, got 0)
:: [   LOG    ] :: Filesystem      Size  Used Avail Use% Mounted on
:: [   LOG    ] :: /dev/loop1       93M  1.6M   85M   2% /var/log/audit
:: [   LOG    ] :: Duration: 13s
:: [   LOG    ] :: Assertions: 11 good, 0 bad
:: [   PASS   ] :: RESULT: Setup

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: Test
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: [   PASS   ] :: Running 'dd if=/dev/urandom of=/var/log/audit/trash.log bs=1M count=30' (Expected 0, got 0)
:: [   PASS   ] :: Running 'tail /var/log/audit/audit.log | grep SYSLOG_MSG-out-of-space-audit-log-test' (Expected 0, got 0)
:: [   PASS   ] :: Running 'tail /var/log/messages | grep -e 'auditd.*Audit daemon is low on disk space for logging' ' (Expected 0, got 0)
:: [   PASS   ] :: Running 'rm -f /var/log/audit/trash.log' (Expected 0, got 0)
:: [   PASS   ] :: Running 'dd if=/dev/urandom of=/var/log/audit/trash.log bs=1M count=60' (Expected 0, got 0)
:: [   PASS   ] :: Running 'tail /var/log/audit/audit.log | grep SUSPEND_MSG-trigger' (Expected 0, got 0)
:: [   PASS   ] :: Running 'tail /var/log/messages | grep -e 'auditd.*Audit daemon is suspending logging due to low disk space.'' (Expected 0, got 0)
:: [   PASS   ] :: Daemon should be suspended and thefore no record found. (Expected 1, got 1)
:: [   PASS   ] :: Running 'rm -f /var/log/audit/trash.log' (Expected 0, got 0)
:: [   PASS   ] :: Running '/sbin/service auditd resume' (Expected 0, got 0)
:: [   PASS   ] :: Running 'tail /var/log/audit/audit.log | grep RESUMED-out-of-space-audit-log-test ' (Expected 0, got 0)
:: [   PASS   ] :: Running 'df -h /var/log/audit' (Expected 0, got 0)
:: [   PASS   ] :: Running '/sbin/service auditd status' (Expected 0, got 0)
:: [   LOG    ] :: Duration: 15s
:: [   LOG    ] :: Assertions: 13 good, 0 bad
:: [   PASS   ] :: RESULT: Test
Comment 5 Ludek Smid 2014-06-13 06:21:59 EDT
This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.

Note You need to log in before you can comment on or make changes to this bug.