Split dequeue(int) into peek_queue(void) and dequeue(void) dequeue() does two completely separate things, and main() does not use the event returned by dequeue(0). Split them, which cleans up both the caller and the callee. Index: audit/audisp/plugins/remote/audisp-remote.c =================================================================== --- audit.orig/audisp/plugins/remote/audisp-remote.c +++ audit/audisp/plugins/remote/audisp-remote.c @@ -446,14 +446,13 @@ int main(int argc, char *argv[]) do_overflow_action(); rc = 0; while (!suspend && rc >= 0 && transport_ok && - (e = dequeue(1))) { + (e = peek_queue()) != NULL) { rc = relay_event(e->data, strnlen(e->data, MAX_AUDIT_MESSAGE_LENGTH)); if (rc >= 0) { free(e); - e = dequeue(0); // delete it - free(e); + dequeue(); // delete it } } } else Index: audit/audisp/plugins/remote/queue.c =================================================================== --- audit.orig/audisp/plugins/remote/queue.c +++ audit/audisp/plugins/remote/queue.c @@ -616,7 +616,7 @@ int enqueue(event_t *e) return ret; } -event_t *dequeue(int peek) +event_t *peek_queue(void) { event_t *e; int r; @@ -631,8 +631,6 @@ event_t *dequeue(int peek) } if (r != 1) goto err; - if (!peek && q_drop_head(q) != 0) - goto err; return e; err: @@ -641,6 +639,12 @@ err: return NULL; } +void dequeue(void) +{ + if (q_drop_head(q) != 0) + queue_error(); +} + int queue_length(void) { return q_queue_length(q); Index: audit/audisp/plugins/remote/queue.h =================================================================== --- audit.orig/audisp/plugins/remote/queue.h +++ audit/audisp/plugins/remote/queue.h @@ -36,7 +36,8 @@ typedef struct event int init_queue(remote_conf_t *config); int enqueue(event_t *e); -event_t *dequeue(int peek); +event_t *peek_queue(void); +void dequeue(void); int queue_length(void); void destroy_queue(void);