Re: [PATCH V2] audit: try harder to send to auditd upon netlink failure

On Monday, September 07, 2015 05:10:13 AM Richard Guy Briggs wrote: > There are several reports of the kernel losing contact with auditd when > it is, in fact, still running. When this happens, kernel syslogs show: > "audit: *NO* daemon at audit_pid=" > although auditd is still running, and

[PATCH V2] audit: try harder to send to auditd upon netlink failure

There are several reports of the kernel losing contact with auditd when it is, in fact, still running. When this happens, kernel syslogs show: "audit: *NO* daemon at audit_pid=" although auditd is still running, and is apparently happy, listening on the netlink socket. The pid in the "*NO*