From: 宋建昌 <songjianchang@troila.com>
To: linux-audit <linux-audit@redhat.com>
Subject: auditd process memory leak
Date: Wed, 23 Jun 2021 13:49:19 +0800 [thread overview]
Message-ID: <tencent_7E0BEF7A5F28F92633406D10@qq.com> (raw)
[-- Attachment #1.1: Type: text/plain, Size: 2065 bytes --]
My environment：
CPU: Kunpeng 910
arch: aarch64
system: Kylin Linux Advanced Server release V10 (Tercel)
kernel: 4.19.90-23.6.v2101.ky10.aarch64
auditd version:
audit-libs-3.0-5.se.06.ky10.aarch64
audit-3.0-5.se.06.ky10.aarch64
python3-audit-3.0-5.se.06.ky10.aarch64
Auditd process uses an increasing amount of memory
dmesg:
[2358791.243830] audit: type=1305 audit(1624265846.064:245837): audit_pid=0 old=1143857 auid=4294967295
ses=4294967295 res=1
[2358791.256815] audit: type=1131 audit(1624265846.074:245838): pid=1 uid=0 auid=4294967295 ses=4294967295
msg='unit=auditd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
[2358791.328435] audit: type=1305 audit(1624265846.154:245839): audit_enabled=1 old=1 auid=4294967295
ses=4294967295 res=1
[2358791.333944] audit: type=1305 audit(1624265846.154:245840): audit_pid=1275570 old=0 auid=4294967295
ses=4294967295 res=1
audit log:
type=NETFILTER_CFG msg=audit(1624410740.017:257002): table=filter family=2 entries=1821
type=SYSCALL msg=audit(1624410740.017:257002): arch=c00000b7 syscall=208 success=yes exit=0 a0=4 a1=0 a2=40 a3=fffd30290010 items=0 ppid=108096 pid=3965028 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables-restor" exe="/usr/sbin/xtables-legacy-multi" key=(null)
type=PROCTITLE msg=audit(1624410740.017:257002): proctitle=69707461626C65732D726573746F7265002D770035002D2D6E6F666C757368002D2D636F756E74657273
type=NETFILTER_CFG msg=audit(1624410740.037:257003): table=nat family=2 entries=1575
type=SYSCALL msg=audit(1624410740.037:257003): arch=c00000b7 syscall=208 success=yes exit=0 a0=4 a1=0 a2=40 a3=aaadea0c1700 items=0 ppid=108096 pid=3965028 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables-restor" exe="/usr/sbin/xtables-legacy-multi" key=(null)
type=PROCTITLE msg=audit(1624410740.037:257003): proctitle=69707461626C65732D726573746F7265002D770035002D2D6E6F666C757368002D2D636F756E74657273
[-- Attachment #1.2: Type: text/html, Size: 4408 bytes --]
[-- Attachment #2: auditd-top.png --]
[-- Type: application/octet-stream, Size: 88085 bytes --]
[-- Attachment #3: Type: text/plain, Size: 106 bytes --]
--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit
reply other threads:[~2021-06-28 13:25 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=tencent_7E0BEF7A5F28F92633406D10@qq.com \
--to=songjianchang@troila.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).