[Open-scap] OpenSCAP Error, Missing Library?

[Steve Grubb]

Hello,

On Friday, April 26, 2013 11:24:11 AM Przemek Klosowski wrote:
> On 04/24/2013 04:32 AM, Anthony Davis wrote:
> > Thanks for helping with this, this is actually very interesting to learn.
> > so here is the output of the lsof
> > 
> > [root at server ~]# ls -l /proc/5232/fd/6
> > lrwx------ 1 root root 64 Apr 24 09:29 /proc/5232/fd/6 -> socket:[32890]
> > [root at server ~]# lsof | grep 32890
> > oscap     5232      root    6u     unix 0xffff8101352bb740      0t0     
> > 32890 socket probe_env 5259      root    6u     unix 0xffff8101352bb740  
> >    0t0      32890 socket probe_una 5302      root    6u     unix
> > 0xffff8101352bb740      0t0      32890 socket probe_rpm 5343      root   
> > 6u     unix 0xffff8101352bb740      0t0      32890 socket probe_pro 5348 
> >     root    6u     unix 0xffff8101352bb740      0t0      32890 socket
>
> OK, then it's one of those processes. strace -p 5259, strace -p 5302,
> etc. The tricky part is that if it's blocked in a syscall (rather than
> bogged down in a fast loop), it already happened earlier so it won't be
> shown. I am really curious what is causing all that---be sure to let us
> know when you figure it out.

Before going too much farther, Peter said about a week ago that you simply 
need a newer version of openscap.

https://www.redhat.com/archives/open-scap-list/2013-April/msg00033.html

Please update and see if that solves your issues. Looking at the EPEL repo, 
0.9.2 is the last one built. There have been quite a few bug fixes since then, 
meaning you want something newer than it. But its spec file can be reused for 
the 0.9.7 release if you want to build you own.

-Steve