LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Fedora
User Name
Password
Fedora This forum is for the discussion of the Fedora Project.

Notices


Reply
  Search this Thread
Old 07-31-2005, 12:38 AM   #1
mkoljack
Member
 
Registered: Jan 2005
Location: Chicago
Distribution: Fedora Core 4, Suse 9.3
Posts: 186

Rep: Reputation: 30
Shutdown Errors


My FC4 system was shutting down clean, now with many recent updates I have the following:

1. Shutdown error cannot connect to audt system

2. This is from /var/log/msg.1

Jul 18 04:12:33 greyhounds auditd[2185]: The audit daemon is exiting.

Jul 18 04:12:33 greyhounds kernel: audit: *NO* daemon at audit_pid=2185

Jul 18 04:12:33 greyhounds kernel: audit(1121677953.913:11206694): arch=40000003 syscall=102 success=no exit=-22 a0=b a1=bfac1110 a2=80510f8 a3=0 items=0 pid=12763 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 comm="auditctl" exe="/sbin/auditctl"

Jul 18 04:12:33 greyhounds kernel: audit(1121677953.913:11206694): saddr=100000000000000000000000

Jul 18 04:12:33 greyhounds kernel: audit(1121677953.913:11206694): nargs=6 a0=3 a1=bfac326c a2=10 a3=0 a4=bfac5408 a5=c

Jul 18 04:12:34 greyhounds kernel: audit(1121677954.013:11206709): SELinux: unrecognized netlink message type=1009 for sclass=49

Jul 18 04:12:34 greyhounds kernel:

Jul 18 04:12:34 greyhounds kernel: audit(1121677954.013:11206709): arch=40000003 syscall=102 success=no exit=-22 a0=b a1=bfac10f0 a2=80510f8 a3=0 items=0 pid=12763 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 comm="auditctl" exe="/sbin/auditctl"

Jul 18 04:12:34 greyhounds kernel: audit(1121677954.013:11206709): saddr=100000000000000000000000

Jul 18 04:12:34 greyhounds kernel: audit(1121677954.013:11206709): nargs=6 a0=3 a1=bfac324c a2=10 a3=0 a4=bfac53e8 a5=c

Any ideas on how to remedy?? Thanks.
 
Old 07-31-2005, 07:04 PM   #2
w6bi
Member
 
Registered: Feb 2003
Location: Simi Valley, Calif
Distribution: Fedora 7
Posts: 69

Rep: Reputation: 15
Sounds like somehow your audit daemon got shut off. To check (as root) (su - )

service auditd status

You should get something like:

auditd (pid 2234) is running...

If not, try running

service auditd start

If it starts without errors, then it's not set to start upon boot. You can fix that with

chkconfig auditd on

If it won't start (fails with errors), post them; maybe someone can help you figure out why auditd can't start.
 
Old 08-01-2005, 12:05 AM   #3
mkoljack
Member
 
Registered: Jan 2005
Location: Chicago
Distribution: Fedora Core 4, Suse 9.3
Posts: 186

Original Poster
Rep: Reputation: 30
auditd

Thanks again for posting a response. So I get as root:

auditd (pid 2216) is running...

When the system is shutting down the error msg. says:

Jul 18 04:12:33 greyhounds kernel: audit: *NO* daemon at audit_pid=2185

So, pid 2185 is not running and 2216 is. What do you recommend I do for this? Thank you for looking at this.
 
Old 08-01-2005, 12:58 AM   #4
w6bi
Member
 
Registered: Feb 2003
Location: Simi Valley, Calif
Distribution: Fedora 7
Posts: 69

Rep: Reputation: 15
Try this, as root:

service auditd stop

rm /var/run/auditd.pid (might be a dead lock file).

service auditd start

If that doesn't work, I'm out of ideas...
 
Old 08-02-2005, 09:31 PM   #5
moniker117
Member
 
Registered: May 2005
Location: Los Angeles, CA, USA
Distribution: Arch
Posts: 48

Rep: Reputation: 15
Quote:
Originally posted by w6bi
Try this, as root:

service auditd stop

rm /var/run/auditd.pid (might be a dead lock file).

service auditd start

If that doesn't work, I'm out of ideas...
Hello everyone,

I'm having a similar problem. I tried doing what you suggested and it didn't help. Any other ideas?

Thanks
 
Old 08-02-2005, 10:32 PM   #6
mkoljack
Member
 
Registered: Jan 2005
Location: Chicago
Distribution: Fedora Core 4, Suse 9.3
Posts: 186

Original Poster
Rep: Reputation: 30
It appears to be a SELinux problem. I have no idea if this should be published as a bug report to Red Hat as it appears not to be an isolated problem. Google research only shows similar errors in compiling kernels nothing as it relates to FC4 or SELinux. Anyone with more knowledge would be helpful??
 
Old 08-02-2005, 11:24 PM   #7
moniker117
Member
 
Registered: May 2005
Location: Los Angeles, CA, USA
Distribution: Arch
Posts: 48

Rep: Reputation: 15
Quote:
Originally posted by mkoljack
It appears to be a SELinux problem. I have no idea if this should be published as a bug report to Red Hat as it appears not to be an isolated problem. Google research only shows similar errors in compiling kernels nothing as it relates to FC4 or SELinux. Anyone with more knowledge would be helpful??
Hi mkoljack and everyone else,

I was looking through the redhat bug listings and apparantly someone did post it. Here's the bug number:
Bug No: 163500
Apparantly one possible solution is to downgrade auditd.

Thanks
 
Old 08-02-2005, 11:37 PM   #8
mkoljack
Member
 
Registered: Jan 2005
Location: Chicago
Distribution: Fedora Core 4, Suse 9.3
Posts: 186

Original Poster
Rep: Reputation: 30
Thanks moniker117. I didn't look through Bugzilla. Normally even Bugzilla comes up in google searches. Anyway, you found it. Thanks so much. The answer appears to be wait till kernel patches and SELinux policy updates happen and check multiple installs of named pkgs in the Bugzilla post.

Thanks again.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
modprobe errors on shutdown Fruitbat Linux - General 5 11-09-2005 02:13 PM
umount2 errors on shutdown sruckh Linux - Software 0 04-15-2004 12:29 AM
Shutdown Errors jburkhcoug Fedora 0 03-16-2004 01:43 AM
Unclean shutdown from power failure... filesystem check errors macisaac Linux - General 4 12-26-2003 07:50 PM
errors on shutdown infamous41md Linux - Newbie 3 04-07-2003 09:32 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Fedora

All times are GMT -5. The time now is 10:58 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration