Hi Leila,
thanks. Unfortunately this doesn't seem to be the problem.
/etc/X11/xorg.conf is identical on all systems (at least regarding the
section in question), while only one system has the described problem.
frank
On 10/03/2013 06:49 PM, Leila Kemery wrote:
Hi Frank,
I found this thread, searched for SOLVED:
http://www.centos.org/modules/newbb/viewtopic.php?topic_id=37724&forum=57,
"The solution was, as expected, trivial and obscure-
With the vanilla install of CentOS 6.2 the X11 color definition file
that is part of the xorg-x11-server-utils package (X.Org X11 X server
utilities) is not resolved correctly by X11.
For some apps this results in warning messages but others fail with
unrelated errors.
The solution was to add the following explicitly to the
/etc/X11/xorg.conf file "Files" section:
Section "Files"
RgbPath "/usr/share/X11/rgb.txt"
EndSection
With this in place, a simple logout/login to restart the X server fixed
the problem. "
On Thu, Oct 3, 2013 at 4:39 AM, Frank Thommen <[email protected]
<mailto:[email protected]>> wrote:
Hi,
on a CentOS 6.4-workstation we have the problem, that Xorg fills up
/var/log/Xorg.0.log with AUDIT messages faster than one can read.
Within four hours the logfile grew to 160 MB and usually within 1-2
days applications and sometimes the OS crash because /var becomes full.
Here a small extract of /var/log/Xorg.0.log:
[...]
[ 24272.458] AUDIT: Wed Oct 2 15:41:44 2013: 2625: client 28
disconnected
[ 24272.487] AUDIT: Wed Oct 2 15:41:44 2013: 2625: client 28
connected from local host ( uid=9435 gid=577 pid=24951 )
Auth name: MIT-MAGIC-COOKIE-1 ID: 572
[ 24272.490] AUDIT: Wed Oct 2 15:41:44 2013: 2625: client 28
disconnected
[ 24272.500] AUDIT: Wed Oct 2 15:41:44 2013: 2625: client 30
disconnected
[ 24272.516] AUDIT: Wed Oct 2 15:41:44 2013: 2625: client 28
connected from local host ( uid=9435 gid=577 pid=24948 )
Auth name: MIT-MAGIC-COOKIE-1 ID: 572
[ 24272.516] AUDIT: Wed Oct 2 15:41:44 2013: 2625: client 30
connected from local host ( uid=9435 gid=577 pid=24952 )
Auth name: MIT-MAGIC-COOKIE-1 ID: 572
[ 24272.521] AUDIT: Wed Oct 2 15:41:44 2013: 2625: client 28
disconnected
[ 24272.549] AUDIT: Wed Oct 2 15:41:44 2013: 2625: client 28
connected from local host ( uid=9435 gid=577 pid=24957 )
Auth name: MIT-MAGIC-COOKIE-1 ID: 572
[ 24272.552] AUDIT: Wed Oct 2 15:41:44 2013: 2625: client 28
disconnected
[ 24272.564] AUDIT: Wed Oct 2 15:41:44 2013: 2625: client 30
disconnected
[ 24272.575] AUDIT: Wed Oct 2 15:41:44 2013: 2625: client 28
connected from local host ( uid=9435 gid=577 pid=24954 )
Auth name: MIT-MAGIC-COOKIE-1 ID: 572
[ 24272.577] AUDIT: Wed Oct 2 15:41:44 2013: 2625: client 30
connected from local host ( uid=9435 gid=577 pid=24958 )
Auth name: MIT-MAGIC-COOKIE-1 ID: 572
[ 24272.585] AUDIT: Wed Oct 2 15:41:44 2013: 2625: client 28
disconnected
[ 24272.612] AUDIT: Wed Oct 2 15:41:44 2013: 2625: client 28
connected from local host ( uid=9435 gid=577 pid=24963 )
Auth name: MIT-MAGIC-COOKIE-1 ID: 572
[ 24272.616] AUDIT: Wed Oct 2 15:41:44 2013: 2625: client 28
disconnected
[ 24272.628] AUDIT: Wed Oct 2 15:41:44 2013: 2625: client 30
disconnected
[ 24272.630] AUDIT: Wed Oct 2 15:41:44 2013: 2625: client 28
connected from local host ( uid=9435 gid=577 pid=24960 )
Auth name: MIT-MAGIC-COOKIE-1 ID: 572
[ 24272.633] AUDIT: Wed Oct 2 15:41:44 2013: 2625: client 30
connected from local host ( uid=9435 gid=577 pid=24964 )
Auth name: MIT-MAGIC-COOKIE-1 ID: 572
[ 24272.644] AUDIT: Wed Oct 2 15:41:44 2013: 2625: client 28
disconnected
[ 24272.673] AUDIT: Wed Oct 2 15:41:44 2013: 2625: client 28
connected from local host ( uid=9435 gid=577 pid=24969 )
Auth name: MIT-MAGIC-COOKIE-1 ID: 572
[ 24272.679] AUDIT: Wed Oct 2 15:41:44 2013: 2625: client 28
disconnected
[ 24272.691] AUDIT: Wed Oct 2 15:41:44 2013: 2625: client 30
disconnected
[ 24272.692] AUDIT: Wed Oct 2 15:41:44 2013: 2625: client 28
connected from local host ( uid=9435 gid=577 pid=24966 )
Auth name: MIT-MAGIC-COOKIE-1 ID: 572
[ 24272.697] AUDIT: Wed Oct 2 15:41:44 2013: 2625: client 30
connected from local host ( uid=9435 gid=577 pid=24970 )
Auth name: MIT-MAGIC-COOKIE-1 ID: 572
[ 24272.711] AUDIT: Wed Oct 2 15:41:44 2013: 2625: client 28
disconnected
[...]
The client numbers are just a small repeating set, but trying to
find the associated processes through the pids fails, because when
the logfile entry is written, the processes are already gone. For
sure these messages are associated with "something" the user(s) do,
because as soon as nobody is logged in, these messages stop. We
have lots of CentOS 6 machines, but this is the only one with such
an issue, even though there are more or less the same applications
running on all machines.
Xorg is running with the following options (CentOS 6 default settings):
/usr/bin/Xorg :0 -nr -verbose -audit 4 -auth
/var/run/gdm/auth-for-gdm-__jQ4DVP/database -nolisten tcp vt1
Questions:
* How can one find out which processes are responsible for these
audit messages?
* How can I stop auditing completely? With CentOS 5 Xorg ran
with "audit 0" and I was unable to find the place where the
audit level is set.
* (more generally) What's auditing good/used for anyway?
Any hint is appreciated.
Cheers
frank
_________________________________________________
Tech mailing list
[email protected] <mailto:[email protected]>
https://lists.lopsa.org/cgi-__bin/mailman/listinfo/tech
<https://lists.lopsa.org/cgi-bin/mailman/listinfo/tech>
This list provided by the League of Professional System Administrators
http://lopsa.org/
--
Leila Kemery
_______________________________________________
Tech mailing list
[email protected]
https://lists.lopsa.org/cgi-bin/mailman/listinfo/tech
This list provided by the League of Professional System Administrators
http://lopsa.org/
