[Bug 2129973] Re: 22.04 / 5.15 - kauditd hanging when installing packages (intermittent)

Hello - is there anything else I can provide to aid with trying to
determine root cause? The only thing I've definitively been able to do
to temporarily fix the issue is stop the audit daemon while we install
larger packages that have many files/lots of file changes during
install.

--
You received this bug notification because you are subscribed to linux
in Ubuntu.
Matching subscriptions: Bgg, Bmail, Nb
https://bugs.launchpad.net/bugs/2129973

Title:
22.04 / 5.15 - kauditd hanging when installing packages (intermittent)

Status in linux package in Ubuntu:
New

Bug description:
We are currently having an issue where installing certain packages
(e.g. linux headers) is causing the kauditd process to spike to 100%
and subsequently make the server unresponsive, requiring a hard
restart. We didn't start noticing this issue until around 10/6. The
same auditd rules are being run on other Ubuntu 16.04 ESM, Ubuntu
18.04 ESM, and Ubuntu 20.04 ESM VMs without issue. All of our VMs are
hosted in AWS. We do have a mix of non-FIPS enabled machines and FIPS
enabled machines, but the issue has occurred on both kernel variants
(version 5.15.x either by the aws-lts kernel package or aws-fips
kernel package).

I've checked kern.log and other than auditd buffer pressure, I don't
see anything specific relating to crashes/etc.

This might be a bit of a reach, but this issue seems related to 5.15
in some way based on the behavior we are seeing... so this is why I'm
submitting a bug report.

We just worked through getting the server I took the output below from
updated to -1095. It was on - 1093 previously.

cat /proc/version_signature
Ubuntu 5.15.0-1095.102-aws 5.15.189
---
ProblemType: Bug
AlsaDevices:
total 0
crw-rw---- 1 root audio 116, 1 Oct 28 09:33 seq
crw-rw---- 1 root audio 116, 33 Oct 28 09:33 timer
AplayDevices: Error: [Errno 2] No such file or directory: 'aplay'
ApportVersion: 2.20.11-0ubuntu82.10
Architecture: amd64
ArecordDevices: Error: [Errno 2] No such file or directory: 'arecord'
AudioDevicesInUse: Error: command ['fuser', '-v', '/dev/snd/seq', '/dev/snd/timer'] failed with exit code 1:
CRDA: N/A
CasperMD5CheckResult: unknown
CloudArchitecture: x86_64
CloudID: aws-gov
CloudName: aws
CloudPlatform: ec2
CloudRegion: us-gov-west-1
CloudSubPlatform: metadata (http://169.254.169.254)
DistroRelease: Ubuntu 22.04
Ec2AMI: ami-04ce3a1ee7cd46362
Ec2AMIManifest: (unknown)
Ec2Architecture: x86_64
Ec2AvailabilityZone: us-gov-west-1a
Ec2InstanceType: t3a.2xlarge
Ec2Kernel: unavailable
Ec2Ramdisk: unavailable
IwConfig: Error: [Errno 2] No such file or directory: 'iwconfig'
Lsusb: Error: command ['lsusb'] failed with exit code 1:
Lsusb-t:

Lsusb-v: Error: command ['lsusb', '-v'] failed with exit code 1:
MachineType: Amazon EC2 t3a.2xlarge
Package: linux (not installed)
PciMultimedia:

ProcEnviron:
TERM=xterm
PATH=(custom, no user)
LANG=C.UTF-8
SHELL=/bin/bash
ProcFB:

ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-5.15.0-1095-aws root=PARTUUID=1e5500b8-b14b-4fdf-b92b-8c4a06090114 ro audit=1 console=tty1 console=ttyS0 nvme_core.io_timeout=4294967295 panic=-1
ProcVersionSignature: Ubuntu 5.15.0-1095.102-aws 5.15.189
RelatedPackageVersions:
linux-restricted-modules-5.15.0-1095-aws N/A
linux-backports-modules-5.15.0-1095-aws N/A
linux-firmware N/A
RfKill: Error: [Errno 2] No such file or directory: 'rfkill'
Tags: jammy ec2-images
Uname: Linux 5.15.0-1095-aws x86_64
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: N/A
_MarkForUpload: True
dmi.bios.date: 10/16/2017
dmi.bios.release: 1.0
dmi.bios.vendor: Amazon EC2
dmi.bios.version: 1.0
dmi.board.asset.tag: i-024f13b1245e8c808
dmi.board.vendor: Amazon EC2
dmi.chassis.asset.tag: Amazon EC2
dmi.chassis.type: 1
dmi.chassis.vendor: Amazon EC2
dmi.modalias: dmi:bvnAmazonEC2:bvr1.0:bd10/16/2017:br1.0:svnAmazonEC2:pnt3a.2xlarge:pvr:rvnAmazonEC2:rn:rvr:cvnAmazonEC2:ct1:cvr:sku:
dmi.product.name: t3a.2xlarge
dmi.sys.vendor: Amazon EC2

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2129973/+subscriptions