Package: auditd Version: 1:2.4-1+b1 Severity: important Dear Maintainer,
"aureport -i --file --summary", after upgrade to Debian 8, started to lock up with 100% CPU usage. It does not exit for hours (it is started by cron job ant midnight), and I have to kill it in the morning. It appears that it happens only on some specific inputs, i.e. not every day. aureport gets is input from: ausearch --raw -k identity I've attached ausearch input, and I can reproduce lock up with: "aureport -i --file --summary --input ausearch_raw_k_identity.txt" -- System Information: Debian Release: 8.6 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 3.16.0-4-amd64 (SMP w/4 CPU cores) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) Versions of packages auditd depends on: ii gawk 1:4.1.1+dfsg-1 ii init-system-helpers 1.22 ii libaudit1 1:2.4-1+b1 ii libauparse0 1:2.4-1+b1 ii libc6 2.19-18+deb8u6 ii libgssapi-krb5-2 1.12.1+dfsg-19+deb8u2 ii libkrb5-3 1.12.1+dfsg-19+deb8u2 ii libwrap0 7.6.q-25 ii lsb-base 4.1+Debian13+nmu1 ii mawk 1.3.3-17 auditd recommends no packages. Versions of packages auditd suggests: pn audispd-plugins <none> -- Configuration Files: /etc/audisp/audispd.conf [Errno 13] Permission denied: u'/etc/audisp/audispd.conf' /etc/audisp/plugins.d/af_unix.conf [Errno 13] Permission denied: u'/etc/audisp/plugins.d/af_unix.conf' /etc/audisp/plugins.d/syslog.conf [Errno 13] Permission denied: u'/etc/audisp/plugins.d/syslog.conf' /etc/audit/audit.rules f9869e1191838c461f5b9051c78a638d [Errno 13] Permission denied: u'/etc/audit/audit.rules f9869e1191838c461f5b9051c78a638d' /etc/audit/auditd.conf [Errno 13] Permission denied: u'/etc/audit/auditd.conf' /etc/audit/rules.d/audit.rules [Errno 13] Permission denied: u'/etc/audit/rules.d/audit.rules'
ausearch_raw_k_identity.txt.gz
Description: application/gzip
