deadlock/hang

[Steve Grubb]

On Wednesday 29 June 2005 03:03, David Woodhouse wrote:
> Show SysRq-T, SysRq-P output.

I don't have serial cable or spare computer with serial port.

However, I did track the problem down somewhat. It turns out that:

auditctl -a entry,always -S socketcall

is what triggers the hang. I remember auditing socket calls when working on 
ausearch interpretation code. So I booted into old kernels.

.61 runs, but starts heavy disk activity.
.62 runs, but reports backlog overflow to console
.63 hangs.

The changelog for .63 says:
- Wait for backlog to drain where possible

So, my guess is that there is something in the draining of the backlog that 
causes this problem. The audit logs from .62 shows that recvfrom() for auditd 
is being audited over and over.

I also wonder if this is related to the problem Debbie & Denise were 
reporting? It seems similar - system hung, no visible indicators that it hit 
the backlog draining.

-Steve