Description of problem:

In audit 2.2.2-2 there is the following change in audisp-remote.c when compared to 2.2.1-2:

< if (sock > 0 && FD_ISSET(sock, &wfd))
< send_one(queue);
---
> if (sock > 0 && FD_ISSET(sock, &wfd)) {
> // If so, try to drain backlog
> while (q_queue_length(queue)&& !suspend && transport_ok)
> send_one(queue);
> }

Sending a pile of messages from the queue might be a problem if, for instance, remote audit.log partition is full and audit-remote plug-in action in set to "stop". In that case all records from queue will be sent as far as I can see and (eg.) rsyslog will be totally over-flooded with "remote logging stopping due to remote server's disk is full, disk full" messages.

I am not sure if this is intended or not, but aforementioned flooding can be reproduced quite easily. In just 2 minutes, I see 397797 messages "remote logging stopping..." in /v/l/m.

Version-Release number of selected component (if applicable):

audit-2.2.2-2.el7

How reproducible:

100%

Steps to Reproduce:

1. configure audit remote logging with disk full action "stop"
2. fill remote audit partition so that disk full action is triggered
3. search "remote logging stopping..." message in /v/l/m
  
Actual results:

Thousands of messages found, over-flooded /var/log/messages (but auditd is correctly stopped).

Expected results:

A reasonable number of messages found (and auditd stopped).

Additional info:

There is a very reliable reproducer available in our development branch of audit-test for RHEL7.