On Thu, 2004-10-21 at 13:20 -0400, Stephen Smalley wrote: > I've seen this before, although not recently, and it has been reported > on this list by at least Russell Coker and Tom London. Ah, ok. > Seems to be > difficult to reproduce reliably. I don't know if there is a bugzilla on > it. Rik Faith, who wrote the audit framework, thought it looked similar > to an earlier bug in the audit code that he had fixed. I think Peter is > presently maintaining the code, cc'd. > > What kernel are you running? Latest FC2 kernel, AFAIK: 2.6.8-1.521 When FC3 is out I plan to upgrade more or less immediately, so I'll report back if I still see this then.