https://bugzilla.novell.com/show_bug.cgi?id=273409 ------- Comment #2 from sbeattie@novell.com 2007-05-11 13:25 MST ------- Sorry, I think you must have misunderstood what I said in IRC. I am able to reproduce it ad infinitum if I send SIGUSR1 to 1.2.6-20 pre-update code. That code does the chmod to mode 0440 and then spins out of control. If it is restarted, the 1.2.6-20 will use the audit.log just fine. However, when the update to 1.2.6-22 occurs, the mode is still 0440, but the new code is more strict about the permissions and refuses to run. Natch: vmos102b2:/home/steve # rpm -q audit audit-libs audit-1.2.6-20 audit-libs-1.2.6-20 vmos102b2:/home/steve # ls -l /var/log/audit/ total 52581 -rw-r----- 1 root root 326 May 11 09:02 audit.log -r--r----- 1 root root 53630315 May 10 18:12 audit.log.1 vmos102b2:/home/steve # killall -USR1 auditd vmos102b2:/home/steve # ls -l /var/log/audit/ total 52581 -r--r----- 1 root root 326 May 11 09:02 audit.log -r--r----- 1 root root 53630315 May 10 18:12 audit.log.1 vmos102b2:/home/steve # /etc/init.d/auditd restart Shutting down auditd done Starting auditd done vmos102b2:/home/steve # ls -l /var/log/audit/ total 52581 -r--r----- 1 root root 653 May 11 09:03 audit.log -r--r----- 1 root root 53630315 May 10 18:12 audit.log.1 vmos102b2:/home/steve # rpm -Uvh audit-1.2.6-22.i586.rpm audit-libs-1.2.6-22.i586.rpm Preparing... ########################################### [100%] 1:audit-libs ########################################### [ 50%] 2:audit ########################################### [100%] Updating etc/sysconfig/auditd... startproc: exit status of parent of /sbin/auditd: 6 vmos102b2:/home/steve # /etc/init.d/auditd restart Shutting down auditd done Starting auditd startproc: exit status of parent of /sbin/auditd: 6 done vmos102b2:/home/steve # ls -l /var/log/audit/ total 52581 -r--r----- 1 root root 782 May 11 09:03 audit.log -r--r----- 1 root root 53630315 May 10 18:12 audit.log.1 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.