Date: Thu, 04 Jun 2026 06:15:32 +0000 From: bugzilla-noreply@freebsd.org To: bugs@FreeBSD.org Subject: [Bug 295840] Accumulation of zombie processes on FreeBSD 14.3 systems during sustained high-volume audit trail rotation Message-ID: <bug-295840-227@https.bugs.freebsd.org/bugzilla/>
index | next in thread | raw e-mail
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295840 Bug ID: 295840 Summary: Accumulation of zombie processes on FreeBSD 14.3 systems during sustained high-volume audit trail rotation Product: Base System Version: 14.3-STABLE Hardware: Any OS: Any Status: New Severity: Affects Many People Priority: --- Component: kern Assignee: bugs@FreeBSD.org Reporter: atelkhade@qualys.com Created attachment 271466 --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=271466&action=edit Added zombie collection script with output and data for analysis We are observing an issue on FreeBSD 14.3 where auditd appears to accumulate zombie child processes during frequent audit trail rotation. The issue is seen on systems with high audit event volume and relatively small audit trail file size configuration. Under this condition, audit trail files rotate frequently. Each rotation appears to invoke /etc/security/audit_warn with the closefile argument. Over time, multiple audit_warn processes remain in a defunct/zombie state. Observed behavior: - auditd is running normally. - audit trail files under /var/audit rotate frequently. - Increasing the audit trail file size reduces the rate at which zombies appear, but does not fully eliminate the issue. - The zombie accumulation appears correlated with audit trail rotation frequency. We are attaching logs and system outputs showing the observed zombie processes and audit trail behavior. Let us know if any other details required from our end. -- You are receiving this mail because: You are the assignee for the bug.home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-295840-227>