2

We have several machines running under Fedora 12. We have to deal with complete reinstallation quite often as our product comes with the whole distibution. I've noticed that sometimes soon after new installation a /etc/rc3.d/S11auditd becomes couple of hours younger then the rest in the /etc/rc*.d. The link is valid it just has more recent time tag on it.

Sometimes this happens in /etc/rc5.d and sometimes doesn't happen at all. This might of have something to do with our product, but we have a common deployment process for every machine and we don't mess with audit system, so it doesn't make much sence.

I wonder, what might touch this link and is it ok to let it be?

UPD: found this one in the audit log:

type=CONFIG_CHANGE msg=audit(21.04.2013 13:35:51.964:38128) : audit_backlog_limit=320 old=256 auid=unset ses=unset subj=kernel res=1

It all happens during initialization right after reboot. But not all the time and not on every machine, which is strange.

UPD2: It does happen on every machine, but not every reboot. Possibly only the cold ones. Still digging...

akalenuk
  • 533
  • 2
  • 6
  • 16

1 Answers1

1

It nappens every time RPM base is altered. Say, I've installed vim - and caught this one the next reboot. On the corresponding runlevel.

And yes, as deployment naturally goes sequential: one machine at the time - some of the machines have this issue at every given moment, and some just don't have it yet. As soon as all the software is properly installed, the config remains untouched.

akalenuk
  • 533
  • 2
  • 6
  • 16