RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 830780 - resume action from initscript is no longer supported
Summary: resume action from initscript is no longer supported
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: audit
Version: 7.0
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: beta
: ---
Assignee: Steve Grubb
QA Contact: Ondrej Moriš
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-06-11 12:02 UTC by Ondrej Moriš
Modified: 2014-06-13 10:21 UTC (History)
0 users

Fixed In Version: audit-2.3-1
Doc Type: Bug Fix
Doc Text:
Clone Of:
: 916611 (view as bug list)
Environment:
Last Closed: 2014-06-13 10:21:59 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)

Description Ondrej Moriš 2012-06-11 12:02:20 UTC 
Description of problem:

In RHEL7 resume action is no longer supported for audit - or, better said, it is not possible to call 'service auditd resume' in order to wake up auditd after suspend. I am aware of the fact that it is possible to send a signal to resume suspended auditd, should it be the only way? Let's discuss it.

Version-Release number of selected component (if applicable):

audit-2.2.1-1.el7.x86_64

How reproducible:

100%

Steps to Reproduce:

1. set e.g. low disk action to "suspend"
2. fill the audit partition to triggrer suspending
3. find a way how to resume auditd :-) 
  
Actual results:

'service auditd resume' - action resume is not supported

Expected results:

e.g. wrap resume action into 'auditd-resume' call or something like that

Additional info:

I consider sending resume signal (SIGUSR2) directly by using 'kill' to be acceptable solution.
Comment 3 Steve Grubb 2013-04-17 12:49:05 UTC 
Fixed in upstream commit 777.
Comment 4 Ondrej Moriš 2013-08-19 22:13:37 UTC 
Successfully verified with audit-2.3.1-2.el7.

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: TEST PROTOCOL
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: [   LOG    ] :: Package       : unknown
:: [   LOG    ] :: Installed:    : unknown is not installed!
:: [   LOG    ] :: Test started  : 2013-08-19 18:07:52 EDT
:: [   LOG    ] :: Test finished : 2013-08-19 18:08:22 EDT
:: [   LOG    ] :: Test name     : /CoreOS/audit/Sanity/low-disk-space-default-warning-suspend-resume
:: [   LOG    ] :: Distro:       : Red Hat Enterprise Linux Server release 7.0 Beta (Maipo)
:: [   LOG    ] :: Hostname      : ibm-x3655-01.ovirt.rhts.eng.bos.redhat.com
:: [   LOG    ] :: Architecture  : x86_64

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: Test description
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

PURPOSE of /CoreOS/audit/Sanity/low-disk-space-default-warning-suspend-resume
Description: Test default actions on low disk space for audit.log partition: 
1) warning, 
2) suspend, 
3) resume 
See RHEL 5.5 errata for details.
Author: Eduard Benes <ebenes>

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: Setup
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: [   PASS   ] :: Checking for the presence of audit rpm 
:: [   LOG    ] :: Package versions:
:: [   LOG    ] ::   audit-2.3.1-2.el7.x86_64
:: [   PASS   ] :: Running 'dd if=/dev/zero of=/tmp/var-log-audit.img bs=1M count=100' (Expected 0, got 0)
:: [   PASS   ] :: Running 'mkfs.ext3 -F /tmp/var-log-audit.img' (Expected 0, got 0)
:: [   PASS   ] :: Running 'mount -o loop /tmp/var-log-audit.img /var/log/audit' (Expected 0, got 0)
:: [   PASS   ] :: Running 'mount | grep audit' (Expected 0, got 0)
:: [   PASS   ] :: Running 'touch /var/log/audit/audit.log' (Expected 0, got 0)
:: [   PASS   ] :: Running 'chmod 0600 /var/log/audit/audit.log' (Expected 0, got 0)
:: [   PASS   ] :: Running 'restorecon -Rv /var/log/audit /var/log/audit/audit.log' (Expected 0, got 0)
:: [   PASS   ] :: Running '/sbin/service auditd stop' (Expected 0, got 0)
:: [   PASS   ] :: Running '/sbin/service auditd start' (Expected 0, got 0)
:: [   LOG    ] :: Restarted auditd with new log file on a fake disk
:: [   PASS   ] :: Running 'tail /var/log/audit/audit.log | grep SETUP_MSG-audit-log-test-msg' (Expected 0, got 0)
:: [   LOG    ] :: Filesystem      Size  Used Avail Use% Mounted on
:: [   LOG    ] :: /dev/loop1       93M  1.6M   85M   2% /var/log/audit
:: [   LOG    ] :: Duration: 13s
:: [   LOG    ] :: Assertions: 11 good, 0 bad
:: [   PASS   ] :: RESULT: Setup

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: Test
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: [   PASS   ] :: Running 'dd if=/dev/urandom of=/var/log/audit/trash.log bs=1M count=30' (Expected 0, got 0)
:: [   PASS   ] :: Running 'tail /var/log/audit/audit.log | grep SYSLOG_MSG-out-of-space-audit-log-test' (Expected 0, got 0)
:: [   PASS   ] :: Running 'tail /var/log/messages | grep -e 'auditd.*Audit daemon is low on disk space for logging' ' (Expected 0, got 0)
:: [   PASS   ] :: Running 'rm -f /var/log/audit/trash.log' (Expected 0, got 0)
:: [   PASS   ] :: Running 'dd if=/dev/urandom of=/var/log/audit/trash.log bs=1M count=60' (Expected 0, got 0)
:: [   PASS   ] :: Running 'tail /var/log/audit/audit.log | grep SUSPEND_MSG-trigger' (Expected 0, got 0)
:: [   PASS   ] :: Running 'tail /var/log/messages | grep -e 'auditd.*Audit daemon is suspending logging due to low disk space.'' (Expected 0, got 0)
:: [   PASS   ] :: Daemon should be suspended and thefore no record found. (Expected 1, got 1)
:: [   PASS   ] :: Running 'rm -f /var/log/audit/trash.log' (Expected 0, got 0)
:: [   PASS   ] :: Running '/sbin/service auditd resume' (Expected 0, got 0)
:: [   PASS   ] :: Running 'tail /var/log/audit/audit.log | grep RESUMED-out-of-space-audit-log-test ' (Expected 0, got 0)
:: [   PASS   ] :: Running 'df -h /var/log/audit' (Expected 0, got 0)
:: [   PASS   ] :: Running '/sbin/service auditd status' (Expected 0, got 0)
:: [   LOG    ] :: Duration: 15s
:: [   LOG    ] :: Assertions: 13 good, 0 bad
:: [   PASS   ] :: RESULT: Test
Comment 5 Ludek Smid 2014-06-13 10:21:59 UTC 
This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.
Note You need to log in before you can comment on or make changes to this bug.