[Bug 191002] [openbsm] auditdistd 1.2-alpha3 leaves kqueue handles open, hits system maxfiles limit

[bz-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=191002

--- Comment #2 from Ryan Steinmetz <zi at FreeBSD.org> ---
mjg reviewed this and believes that for each new file there is new kqueue
descriptor opened (/bin/auditdistd/sender.c -> read_thread_wait ->
wait_for_file_init) ... and that always calls kqueue.  It appears as if the
kqueue descriptors aren't being closed when this happens.

On the systems where this is an issue for me, they are ones that would have
higher-than-usual audit log sizes.  (nagios host, etc.).

A hack-patch might look like this: http://pastebin.com/5SaBUuqF

Although, he recommended that we remove the old watchers as a more proper fix.

-- 
You are receiving this mail because:
You are the assignee for the bug.