auid bug

[Steve]

I am receiving audit events with an odd auid...  I am not sure if this 
is something wrong in the kernel or in audit.  The auid I am receiving 
is 4294967295 (the max value for an unsigned long).  The other uid/gid 
information is normal.

I have seen this on all audit versions since audit-1.2.3, and noticed it 
using the following kernels:

2.6.17-1.2293.2.2_FC6.lspp.38.i686
2.6.17-1.2293.2.2_FC6.lspp.44.i686

The first time I noticed this was after the filter_key patch I applied 
to audit-1.2.3, but it may have nothing to do with that patch.  I 
mentioned it then:

https://www.redhat.com/archives/linux-audit/2006-June/msg00086.html

There is an example record from the audit dispatcher there.

These events are coming straight from the real-time audit dispatcher.

Steve