Thilo Six wrote:
> No. Speaking openly i do not know what it is telling me at all. But reading
> "losing inode data" got my attention so to say.
Yeah. If nothing else, we should tone down the message, rate-limit
it, and make it trigger only once per syscall.
> Those messages happended during boot btw.
> Can you tell me where i can look up the value of 'name_count' maybe in sysctl?
The attached patch (instead of the patches I sent before) should log
enough information to tell.
Thanks,
Jonathan
From: Jonathan Nieder <jrnie...@gmail.com>
Date: Thu, 10 Jan 2013 16:01:03 -0800
Subject: add more debugging output to the auditing subsystem
---
kernel/audit.h | 2 +-
kernel/auditsc.c | 3 ++-
2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/kernel/audit.h b/kernel/audit.h
index 91e7071..f7e1f16 100644
--- a/kernel/audit.h
+++ b/kernel/audit.h
@@ -27,7 +27,7 @@
1 = put_count checking
2 = verbose put_count checking
*/
-#define AUDIT_DEBUG 0
+#define AUDIT_DEBUG 2
/* At task start time, the audit_state is set in the audit_context using
a per-task filter. At syscall entry, the audit_state is augmented by
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 47b7fc1..7e8daa0 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -1902,8 +1902,9 @@ static int audit_inc_name_count(struct audit_context *context,
{
if (context->name_count >= AUDIT_NAMES) {
if (inode)
- printk(KERN_DEBUG "audit: name_count maxed, losing inode data: "
+ printk(KERN_DEBUG "audit(%p:%d): name_count maxed, losing inode data: "
"dev=%02x:%02x, inode=%lu\n",
+ context, context->serial,
MAJOR(inode->i_sb->s_dev),
MINOR(inode->i_sb->s_dev),
inode->i_ino);
--
1.8.1
