Stack Exchange
Restart of auditd causes audispd reconfigure infinite loop
We restart some of our services on Debian jessie every night at 11:45 PM as part of logfile rotation. Among those services that we restart is the auditd service. We are sometimes seeing that audispd goes into an infinite-reconfigure loop when restarted:
2018-03-29T23:45:01.618252-07:00 ldap-uat0 auditd[4739]: config change requested by pid=4066 auid=0 subj=?
2018-03-29T23:45:01.618454-07:00 ldap-uat0 auditd[4739]: audit(1522392301.618:9498) config changed, auid=0 pid=4066 subj=? res=success
2018-03-29T23:45:01.618782-07:00 ldap-uat0 audispd: priority_boost_parser called with: 4
2018-03-29T23:45:01.618963-07:00 ldap-uat0 audispd: max_restarts_parser called with: 10
2018-03-29T23:45:01.619129-07:00 ldap-uat0 audispd: Starting reconfigure
2018-03-29T23:45:03.512051-07:00 ldap-uat0 audispd: plugin /usr/sbin/audisp-simplify terminated unexpectedly
2018-03-29T23:45:03.512250-07:00 ldap-uat0 audispd: plugin /usr/sbin/audisp-simplify has exceeded max_restarts
2018-03-29T23:45:03.512833-07:00 ldap-uat0 audispd: plugin /usr/sbin/audisp-simplify was restarted
2018-03-29T23:45:03.617736-07:00 ldap-uat0 auditd[4739]: config change requested by pid=4066 auid=0 subj=?
2018-03-29T23:45:03.617987-07:00 ldap-uat0 auditd[4739]: audit(1522392303.617:276) config changed, auid=0 pid=4066 subj=? res=success
2018-03-29T23:45:05.621950-07:00 ldap-uat0 audispd: priority_boost_parser called with: 4
2018-03-29T23:45:05.622391-07:00 ldap-uat0 audispd: max_restarts_parser called with: 10
2018-03-29T23:45:05.622774-07:00 ldap-uat0 audispd: Starting reconfigure
2018-03-29T23:45:05.623301-07:00 ldap-uat0 audispd: priority_boost_parser called with: 4
2018-03-29T23:45:05.623593-07:00 ldap-uat0 audispd: max_restarts_parser called with: 10
2018-03-29T23:45:05.623892-07:00 ldap-uat0 audispd: Starting reconfigure

with the three lines
2018-03-29T23:45:05.622774-07:00 ldap-uat0 audispd: Starting reconfigure
2018-03-29T23:45:05.623301-07:00 ldap-uat0 audispd: priority_boost_parser called with: 4
2018-03-29T23:45:05.623593-07:00 ldap-uat0 audispd: max_restarts_parser called with: 10

repeating forever until the disk fill up.
The audisp configuration is in /etc/audisp/audispd.conf:
q_depth = 32767
overflow_action = IGNORE
priority_boost = 4
max_restarts = 10
name_format = HOSTNAME


Did you ever get to the bottom of this?

I never got a solution to this problem.

We fixed the problem by restarting auditd service
command: systemctl restart auditd
