From mboxrd@z Thu Jan  1 00:00:00 1970
From: Steve Grubb <sgrubb@redhat.com>
Subject: Re: RHEL-AS-4.4 and auditd-1.0.14
Date: Mon, 12 Feb 2007 21:33:53 -0500
Message-ID: <200702122133.53780.sgrubb@redhat.com>
References: <8585B1BA-20C5-4733-B12E-A5B85ACE62F5@tusc.com.au>
	<200702100927.43533.sgrubb@redhat.com>
	<D787E2C6-8A9F-4CC1-804D-EF27CEA3B952@tusc.com.au>
Mime-Version: 1.0
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <D787E2C6-8A9F-4CC1-804D-EF27CEA3B952@tusc.com.au>
Content-Disposition: inline
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: Simon Jones <sjones@tusc.com.au>
Cc: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On Monday 12 February 2007 17:54, Simon Jones wrote:
> I loaded just the rules and left it overnight and it still looks fine.
>
> size-32 =A0 =A0 =A0 =A0 =A0 =A0 3688 =A0 3808 =A0 =A0 32 =A0119 =A0 =A0=
1 : tunables =A0120 =A0 =A0
> 60 =A0 =A08 : slabdata =A0 =A0 32 =A0 =A0 32 =A0 =A0 =A00

Hmm...that would seem to point to the audit daemon. I posted the code for=
 the=20
1.0.15 audit package here:

http://people.redhat.com/sgrubb/audit/audit-1.0.15-1.fc4.src.rpm

Maybe you want to build that and give it a try? I'd be curious if you see=
 a=20
leak in that version. It does have some cleanups, but nothing I recall as=
=20
fixing a memory leak.

-Steve