<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> <HTML> <HEAD> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"> <META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7654.12"> <TITLE>dispatch err (pipe full) event lost - audit-1.0.16-4 (2.6.9-67.0.4.ELsmp)</TITLE> </HEAD> <BODY>  <P ALIGN=LEFT><SPAN LANG="en-us"><FONT COLOR="#0000FF" SIZE=2 FACE="Courier New">Hi,</FONT></SPAN></P> <P ALIGN=LEFT><SPAN LANG="en-us"><FONT COLOR="#0000FF" SIZE=2 FACE="Courier New">I could see following event logged continuously on messages log. I am using audit-1.0.16 version with</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"> <FONT COLOR="#0000FF" SIZE=2 FACE="Courier New">SnareLinux-1.5.0-1 version.</FONT></SPAN></P> <P ALIGN=LEFT><SPAN LANG="en-us"><B><FONT COLOR="#0000FF" SIZE=2 FACE="Courier New">auditd[10959]: dispatch err (pipe full) event lost</FONT></B></SPAN></P> <P ALIGN=LEFT><SPAN LANG="en-us"><B><FONT COLOR="#0000FF" SIZE=2 FACE="Courier New">auditd[10959]: dispatch error reporting limit reached - ending report notification.</FONT></B></SPAN></P> <P ALIGN=LEFT><SPAN LANG="en-us"><B><FONT COLOR="#0000FF" SIZE=2 FACE="Courier New">auditd[10959]: dispatch err (pipe full) event lost</FONT></B></SPAN><SPAN LANG="en-us"><B></B></SPAN><SPAN LANG="en-us"><B></B></SPAN></P> <P ALIGN=LEFT><SPAN LANG="en-us"><FONT FACE="Wingdings" SIZE=2>à</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT COLOR="#0000FF" SIZE=2 FACE="Courier New"> /etc/</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT COLOR="#0000FF" SIZE=2 FACE="Courier New">audit.rules</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"> <FONT COLOR="#0000FF" SIZE=2 FACE="Courier New">has</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT COLOR="#0000FF" SIZE=2 FACE="Courier New"> o</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT COLOR="#0000FF" SIZE=2 FACE="Courier New">nly following line</FONT></SPAN></P> <P ALIGN=LEFT><SPAN LANG="en-us"><FONT COLOR="#0000FF" SIZE=2 FACE="Courier New">-b 256</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P> <P ALIGN=LEFT><SPAN LANG="en-us"><FONT FACE="Wingdings" SIZE=2>à</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT COLOR="#0000FF" SIZE=2 FACE="Courier New"></FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"> <FONT COLOR="#0000FF" SIZE=2 FACE="Courier New">/etc/auditd.conf has following contents</FONT></SPAN></P> <P ALIGN=LEFT><SPAN LANG="en-us"><FONT COLOR="#0000FF" SIZE=2 FACE="Courier New">log_file = /var/log/audit/audit.log</FONT></SPAN></P> <P ALIGN=LEFT><SPAN LANG="en-us"><FONT COLOR="#0000FF" SIZE=2 FACE="Courier New">log_format = NOLOG</FONT></SPAN></P> <P ALIGN=LEFT><SPAN LANG="en-us"><FONT COLOR="#0000FF" SIZE=2 FACE="Courier New">priority_boost = 3</FONT></SPAN></P> <P ALIGN=LEFT><SPAN LANG="en-us"><FONT COLOR="#0000FF" SIZE=2 FACE="Courier New">flush = INCREMENTAL</FONT></SPAN></P> <P ALIGN=LEFT><SPAN LANG="en-us"><FONT COLOR="#0000FF" SIZE=2 FACE="Courier New">freq = 20</FONT></SPAN></P> <P ALIGN=LEFT><SPAN LANG="en-us"><FONT COLOR="#0000FF" SIZE=2 FACE="Courier New">num_logs = 4</FONT></SPAN></P> <P ALIGN=LEFT><SPAN LANG="en-us"><FONT COLOR="#0000FF" SIZE=2 FACE="Courier New">#dispatcher = /sbin/audispd</FONT></SPAN></P> <P ALIGN=LEFT><SPAN LANG="en-us"><FONT COLOR="#0000FF" SIZE=2 FACE="Courier New">#disp_qos = lossy</FONT></SPAN></P> <P ALIGN=LEFT><SPAN LANG="en-us"><FONT COLOR="#0000FF" SIZE=2 FACE="Courier New">max_log_file = 5</FONT></SPAN></P> <P ALIGN=LEFT><SPAN LANG="en-us"><FONT COLOR="#0000FF" SIZE=2 FACE="Courier New">max_log_file_action = ROTATE</FONT></SPAN></P> <P ALIGN=LEFT><SPAN LANG="en-us"><FONT COLOR="#0000FF" SIZE=2 FACE="Courier New">space_left = 75</FONT></SPAN></P> <P ALIGN=LEFT><SPAN LANG="en-us"><FONT COLOR="#0000FF" SIZE=2 FACE="Courier New">space_left_action = SYSLOG</FONT></SPAN></P> <P ALIGN=LEFT><SPAN LANG="en-us"><FONT COLOR="#0000FF" SIZE=2 FACE="Courier New">action_mail_acct = root</FONT></SPAN></P> <P ALIGN=LEFT><SPAN LANG="en-us"><FONT COLOR="#0000FF" SIZE=2 FACE="Courier New">admin_space_left = 50</FONT></SPAN></P> <P ALIGN=LEFT><SPAN LANG="en-us"><FONT COLOR="#0000FF" SIZE=2 FACE="Courier New">admin_space_left_action = SUSPEND</FONT></SPAN></P> <P ALIGN=LEFT><SPAN LANG="en-us"><FONT COLOR="#0000FF" SIZE=2 FACE="Courier New">disk_full_action = SUSPEND</FONT></SPAN></P> <P ALIGN=LEFT><SPAN LANG="en-us"><FONT COLOR="#0000FF" SIZE=2 FACE="Courier New">disk_error_action = SUSPEND</FONT></SPAN></P> <P ALIGN=LEFT><SPAN LANG="en-us"><FONT COLOR="#0000FF" SIZE=2 FACE="Courier New">dispatcher = /usr/sbin/SnareDispatchHelper</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P> <P ALIGN=LEFT><SPAN LANG="en-us"><FONT FACE="Wingdings" SIZE=2>à</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT COLOR="#0000FF" SIZE=2 FACE="Courier New"> /etc/snare.conf</FONT></SPAN></P> <P ALIGN=LEFT><SPAN LANG="en-us"><FONT COLOR="#0000FF" SIZE=2 FACE="Courier New">Normal remote log collection server IP and other details.</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P> <P ALIGN=LEFT><SPAN LANG="en-us"><FONT COLOR="#0000FF" SIZE=2 FACE="Courier New">Above setup working from last couple of months without any errors but all of sudden I could see above specified errors from last couple of days. Is there any bug in audit version or snare version?</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P> <P ALIGN=LEFT><SPAN LANG="en-us"></SPAN><A NAME=""><SPAN LANG="en-us"><FONT COLOR="#0000FF" SIZE=2 FACE="Courier New">Regards,<BR> Vasu</FONT></SPAN></A><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P> <P ALIGN=LEFT><SPAN LANG="en-us"></SPAN></P> </BODY> </HTML>