atom feed16 messages in org.freebsd.trustedbsd-auditaudit -t fails on Leopard
FromSent OnAttachments
Robert WatsonJul 31, 2008 5:27 am 
Todd HeberleinJul 31, 2008 8:01 am 
Robert WatsonJul 31, 2008 8:30 am 
mm wJul 31, 2008 9:27 am 
Jacques VidrineJul 31, 2008 10:18 am 
Robert WatsonJul 31, 2008 10:58 am 
Stacey SonJul 31, 2008 11:36 am 
Todd HeberleinJul 31, 2008 2:07 pm 
Todd HeberleinJul 31, 2008 2:16 pm 
Robert WatsonJul 31, 2008 3:04 pm 
Stacey SonJul 31, 2008 3:45 pm 
Todd HeberleinJul 31, 2008 8:50 pm 
Robert WatsonAug 1, 2008 12:47 am 
Todd HeberleinAug 17, 2008 3:05 pm 
Todd HeberleinAug 17, 2008 3:44 pm 
Robert WatsonAug 21, 2008 2:07 pm 
Subject:audit -t fails on Leopard
From:Todd Heberlein (todd@mac.com)
Date:Aug 17, 2008 3:44:00 pm
List:org.freebsd.trustedbsd-audit

On the most recent alpha version of OpenBSM (1.1) on Leopard I have been unable to terminate the audit daemon.

When starting with: # sudo ./auditd -d

All the following efforts to kill the audit daemon failed: (1) ctrl-c (2) # sudo ./audit -t (3) kill -9 <pid>

Furthermore, after trying to kill the audit daemon I have been unable to reboot or shutdown my machine gracefully; a hard power down is required.

-----

When starting with: # sudo ./auditd

Rotating the audit trail *does* work: # sudo ./audit -n

But killing the audit deamon fails (see methods above). Furthermore, once I've tried to kill the audit daemon, "audit -n" fails and the process hangs. And, again, I have been unable to gracefully reboot or shutdown my machine afterwards.

Platform: MacBook Pro Mac OS 10.5.4 (9E17), Darwin 9.4.0

Todd