From: "Steve M. Zak" <smzak@faac.com>
To: "linux-audit@redhat.com" <linux-audit@redhat.com>
Subject: Too many failed open syscalls
Date: Wed, 9 Feb 2011 12:09:50 -0500 [thread overview]
Message-ID: <E2B97F4E65AFD84DA1A7B3BEC35E17140149E6FB40D4@hailstorm.faac.com> (raw)
[-- Attachment #1.1: Type: text/plain, Size: 873 bytes --]
Hi,
audit-2.0.6 sounds interesting.
We have been having an issue that got much worse just recently where the audits based on nispom.rules are generating millions of failed "open" syscall events.
In the past I saw failed open for the lock files under /usr/lib64/qt-3.3/etc/settings/... This seems to be related to KDE and maybe Kdevelop. The number of events were manageable.
gdb is now asking for many files under /usr/local/gcc441/... and under a home directory where gcc was configured where users have read permissions. Does this seem like an audit issue or a gcc/gdb issue? I can filter the audit.log, but 1GB of audit logs a day is too much.
Any help would be appreciated!
Thanks!
____________________________________________
Steve M. Zak
--
This email was Anti Virus checked by Astaro Security Gateway. http://www.astaro.com
[-- Attachment #1.2: Type: text/html, Size: 1575 bytes --]
[-- Attachment #2: Type: text/plain, Size: 0 bytes --]
next reply other threads:[~2011-02-09 17:06 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-02-09 17:09 Steve M. Zak [this message]
2011-02-09 18:17 ` Too many failed open syscalls Steve Grubb
[not found] ` <23B4A3CF-E4F7-434C-8796-0472ADD146C4@mac.com>
2011-02-09 22:20 ` Steve Grubb
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=E2B97F4E65AFD84DA1A7B3BEC35E17140149E6FB40D4@hailstorm.faac.com \
--to=smzak@faac.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.