Question/concern about bsm auditing option on solaris

[Darren Tucker]

Matt Goebel wrote:
>   I downloaded and compiled the Mar 2, 2005 snapshot and compiled it with 
> bsm auditing for solaris turned on.  I've been noticing about a dozen or 
> so of the following messages per day now.  Not sure exactly what it is, or 
> if it is a big issue.
> 
> [ID 800047 auth.crit] fatal: mm_request_send: write

I think I have figured out the cause of this one: it was trying to catch 
the connection close event during the cleanup, but by that time it may be 
too late as the monitor may already be shut down.  If the monitor has 
already shut down then sending the request will fail causing the error 
you're seeing.

Please try the attached patch (which should apply on top of the previous 
patch).

I'll attach the patch to bug #125 too.

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
     Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: openssh-audit-close.patch
Url: http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20050305/279782ec/attachment.ksh