Shutdown Errors
My FC4 system was shutting down clean, now with many recent updates I have the following:
1. Shutdown error cannot connect to audt system 2. This is from /var/log/msg.1 Jul 18 04:12:33 greyhounds auditd[2185]: The audit daemon is exiting. Jul 18 04:12:33 greyhounds kernel: audit: *NO* daemon at audit_pid=2185 Jul 18 04:12:33 greyhounds kernel: audit(1121677953.913:11206694): arch=40000003 syscall=102 success=no exit=-22 a0=b a1=bfac1110 a2=80510f8 a3=0 items=0 pid=12763 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 comm="auditctl" exe="/sbin/auditctl" Jul 18 04:12:33 greyhounds kernel: audit(1121677953.913:11206694): saddr=100000000000000000000000 Jul 18 04:12:33 greyhounds kernel: audit(1121677953.913:11206694): nargs=6 a0=3 a1=bfac326c a2=10 a3=0 a4=bfac5408 a5=c Jul 18 04:12:34 greyhounds kernel: audit(1121677954.013:11206709): SELinux: unrecognized netlink message type=1009 for sclass=49 Jul 18 04:12:34 greyhounds kernel: Jul 18 04:12:34 greyhounds kernel: audit(1121677954.013:11206709): arch=40000003 syscall=102 success=no exit=-22 a0=b a1=bfac10f0 a2=80510f8 a3=0 items=0 pid=12763 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 comm="auditctl" exe="/sbin/auditctl" Jul 18 04:12:34 greyhounds kernel: audit(1121677954.013:11206709): saddr=100000000000000000000000 Jul 18 04:12:34 greyhounds kernel: audit(1121677954.013:11206709): nargs=6 a0=3 a1=bfac324c a2=10 a3=0 a4=bfac53e8 a5=c Any ideas on how to remedy?? Thanks. |
Sounds like somehow your audit daemon got shut off. To check (as root) (su - )
service auditd status You should get something like: auditd (pid 2234) is running... If not, try running service auditd start If it starts without errors, then it's not set to start upon boot. You can fix that with chkconfig auditd on If it won't start (fails with errors), post them; maybe someone can help you figure out why auditd can't start. |
auditd
Thanks again for posting a response. So I get as root:
auditd (pid 2216) is running... When the system is shutting down the error msg. says: Jul 18 04:12:33 greyhounds kernel: audit: *NO* daemon at audit_pid=2185 So, pid 2185 is not running and 2216 is. What do you recommend I do for this? Thank you for looking at this. |
Try this, as root:
service auditd stop rm /var/run/auditd.pid (might be a dead lock file). service auditd start If that doesn't work, I'm out of ideas... |
Quote:
I'm having a similar problem. I tried doing what you suggested and it didn't help. Any other ideas? Thanks |
It appears to be a SELinux problem. I have no idea if this should be published as a bug report to Red Hat as it appears not to be an isolated problem. Google research only shows similar errors in compiling kernels nothing as it relates to FC4 or SELinux. Anyone with more knowledge would be helpful??
|
Quote:
I was looking through the redhat bug listings and apparantly someone did post it. Here's the bug number: Bug No: 163500 Apparantly one possible solution is to downgrade auditd. Thanks |
Thanks moniker117. I didn't look through Bugzilla. Normally even Bugzilla comes up in google searches. Anyway, you found it. Thanks so much. The answer appears to be wait till kernel patches and SELinux policy updates happen and check multiple installs of named pkgs in the Bugzilla post.
Thanks again. |
All times are GMT -5. The time now is 02:40 AM. |