Oops while checking file system auditing

Timothy R. Chavez tinytim at us.ibm.com
Tue May 24 19:26:16 UTC 2005


On Tuesday 24 May 2005 14:19, Steve Grubb wrote:
> On Tuesday 24 May 2005 14:06, Timothy R. Chavez wrote:
> > Can you also provide architecture, UP/SMP, etc
> 
> I just upgraded to the .48 kernel and did this:
> 
> -a entry,always -S mkdir
> -a entry,always -S kill
> -w /etc/passwd -k fk_passwd -p rwea
> -w /var/run/dbus/system_bus_socket -k dbus-test -p rwea
> 
> This kills the machine dead...well except for the blinking numlock & caps lock 
> lights. 

So this message you're getting is indicative of a leaked reference.  I'm curious 
to know if you get the error when you just insert those watches... do you know?

-tim




More information about the Linux-audit mailing list