My FC4 system was shutting down clean, now with many recent updates I have the following:

1. Shutdown error cannot connect to audt system

2. This is from /var/log/msg.1

Jul 18 04:12:33 greyhounds auditd[2185]: The audit daemon is exiting.

Jul 18 04:12:33 greyhounds kernel: audit: *NO* daemon at audit_pid=2185

Jul 18 04:12:33 greyhounds kernel: audit(1121677953.913:11206694): arch=40000003 syscall=102 success=no exit=-22 a0=b a1=bfac1110 a2=80510f8 a3=0 items=0 pid=12763 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 comm="auditctl" exe="/sbin/auditctl"

Jul 18 04:12:33 greyhounds kernel: audit(1121677953.913:11206694): saddr=100000000000000000000000

Jul 18 04:12:33 greyhounds kernel: audit(1121677953.913:11206694): nargs=6 a0=3 a1=bfac326c a2=10 a3=0 a4=bfac5408 a5=c

Jul 18 04:12:34 greyhounds kernel: audit(1121677954.013:11206709): SELinux: unrecognized netlink message type=1009 for sclass=49

Jul 18 04:12:34 greyhounds kernel:

Jul 18 04:12:34 greyhounds kernel: audit(1121677954.013:11206709): arch=40000003 syscall=102 success=no exit=-22 a0=b a1=bfac10f0 a2=80510f8 a3=0 items=0 pid=12763 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 comm="auditctl" exe="/sbin/auditctl"

Jul 18 04:12:34 greyhounds kernel: audit(1121677954.013:11206709): saddr=100000000000000000000000

Jul 18 04:12:34 greyhounds kernel: audit(1121677954.013:11206709): nargs=6 a0=3 a1=bfac324c a2=10 a3=0 a4=bfac53e8 a5=c

Any ideas on how to remedy?? Thanks.

Sounds like somehow your audit daemon got shut off. To check (as root) (su - )

service auditd status

You should get something like:

auditd (pid 2234) is running...

If not, try running

service auditd start

If it starts without errors, then it's not set to start upon boot. You can fix that with

chkconfig auditd on

If it won't start (fails with errors), post them; maybe someone can help you figure out why auditd can't start.

Thanks again for posting a response. So I get as root:

auditd (pid 2216) is running...

When the system is shutting down the error msg. says:

Jul 18 04:12:33 greyhounds kernel: audit: *NO* daemon at audit_pid=2185

So, pid 2185 is not running and 2216 is. What do you recommend I do for this? Thank you for looking at this.

Try this, as root:

service auditd stop

rm /var/run/auditd.pid (might be a dead lock file).

service auditd start

If that doesn't work, I'm out of ideas...

Hello everyone,

I'm having a similar problem. I tried doing what you suggested and it didn't help. Any other ideas?

Thanks

It appears to be a SELinux problem. I have no idea if this should be published as a bug report to Red Hat as it appears not to be an isolated problem. Google research only shows similar errors in compiling kernels nothing as it relates to FC4 or SELinux. Anyone with more knowledge would be helpful??

Hi mkoljack and everyone else,

I was looking through the redhat bug listings and apparantly someone did post it. Here's the bug number:
Bug No: 163500
Apparantly one possible solution is to downgrade auditd.

Thanks

Thanks moniker117. I didn't look through Bugzilla. Normally even Bugzilla comes up in google searches. Anyway, you found it. Thanks so much. The answer appears to be wait till kernel patches and SELinux policy updates happen and check multiple installs of named pkgs in the Bugzilla post.

Thanks again.