retitle 575537 readahead-fedora: collector conflicts with auditd thanks On Monday 03 May 2010 21:05:53 Michael Stone wrote: > After looking at the debug info it seems that the logging stops right > after auditd is started. So the early/later stuff was a red herring, and > everything works fine if I remove auditd. So probably either readahead > should conflict with that package, or something should change to make > them work together. (I guess that it makes sense that they might have > issues, since they're both trying to use the audit subsystem.)
Yes, auditd conflicts with readahead's collector because it removes all the audit rules at startup. One way to workaround the conflict is by starting auditd after stop-readahead- fedora (which can not be easily done via the LSB init headers because of the dependency on $all, so the stop- script would have to call /etc/init.d/auditd start.) But that has the side effect that some audit events are not logged (actually, at present time auditd is incorrectly being started at rc2 instead of rcS, but that's a bug in the script's LSB header.) The alternative is to let the collector use the debugfs like ureadahead does, but requires a kernel patch. It's on my TODO list already but I don't know when I'm going to work on that. P.S. the conflict with auditd is documented in /usr/share/doc/readahead- fedora/README. Cheers, -- Raphael Geissert - Debian Developer www.debian.org - get.debian.net -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
