on machine with CPU -> 100%, lots of avc's

[Christopher Beland]

On Wed, 2009-02-04 at 10:46 -0800, Antonio Olivares wrote:
> I wonder what is wrong auditd is not running :(, it is enabled via
> services, but it is not working:

If you do "ls -l /var/log/audit/", do you get permissions similar to
these?

-rw------- 1 root root 1130062 2009-02-04 18:14 audit.log
-rw------- 1 root root 5243278 2008-12-04 13:35 audit.log.1
-rw------- 1 root root 5243057 2008-11-10 04:02 audit.log.2
-rw------- 1 root root 5243105 2008-08-13 04:57 audit.log.3

I recently ran into a bug with auditd log rotation, which has since been
fixed to prevent permissions problems but not recover from them.

-B.