I have been searching the internet for hours without luck.
I have an office full of machines with multiple versions of opensuse (11.0 11.1 11.2). I have started creating a plan for auditing and logging which will eventually be implemented company wide.
However I am having an issue where SOMETIMES when I go to restart auditd (/etc/init.d/auditd restart) it will completely hang, at this point I cannot do anything to stop the restart (ie. ^C) while my terminal is super hung i try to open a new ssh session to the machine that is hanging only to find out that now ssh is not working. now it starts getting weird. since I cannot ssh to the box ill just walk over and check it out. Nope I try to do almost anything on the box and it completely hangs ( su ping and i believe i tried an init 6 ) but the user that is logged into the box seems to be able to work just fine. Now the real problem with this is that it does not happen every time, after restarting the box (only quick fix that seems to work for now) and performing an /etc/init.d/auditd start it wont happen again. This has happened on multiple computers.
A couple of times it happened I just let the user work and later i find out it seems to have fixed itself (maybe the process timed out i tried to start) and I can ssh and do everything normally.
I have not been able to run top or try to strace the problem because it happens so randomly and im normally on a remote machine. I cannot find anything in the logs that points to any kind of problem.
What I did find online is that some people are mistakenly hitting the disk too full action of suspend however this is not the case.
Any help or suggestions would be greatly appreciated.