Patch for proc_police failure on recent Red Hat 5 -- see comment. Index: src/proc_police.c =================================================================== --- src/proc_police.c (revision 4619) +++ src/proc_police.c (working copy) @@ -271,8 +271,17 @@ processExit(ev->event_data.exit.process_tgid); break; default: - llog(LOG_ERR, "Unknown message: %d\n", ev->what); - return -1; + /* The BPF is failing on recent Red Hat 5 (at least + 2.6.18-308 to 2.6.18-308.8.2), so we most often + get here and would then fail. Brian Bockelman + reports that even a trivial BPF fails. He + recommended this as a workaround, which I'd + already tested. It's safe generally, and coming + through here with the broken filter isn't + resource-hungry. -- Dave Love */ +/* llog(LOG_ERR, "Unknown message: %d\n", ev->what); */ +/* return -1; */ + break; } } }