On 2023/05/06 7:12, Rinat Gadelshin wrote:
> The only one `auditctl -l` request was performed.
> I see the following response in syslog for the request:
Thanks for rules.
I tried "auditctl -l" with these rules, and I got only
audit: Started audit_send_list_thread
audit: Calling netlink_unicast (repeated for 32 times)
audit: Finished audit_send_list_thread
as output; audit_send_reply_thread is not called in my environment.
That is, for some reason (maybe some process is interfering each other)
audit_send_reply_thread is needlessly called in your environment?
In that case, fixing the cause of audit_send_reply_thread being called
could reduce the spam.
Please try to find who is calling audit_send_reply_thread for many times.
diff --git a/kernel/audit.c b/kernel/audit.c
index 9bc0b0301198..bf4fef7da692 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -1006,6 +1011,7 @@ static void audit_send_reply(struct sk_buff *request_skb,
int seq, int type, int
tsk = kthread_run(audit_send_reply_thread, reply, "audit_send_reply");
if (IS_ERR(tsk))
goto err;
+ dump_stack();
return;
--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit
