umount /var busy upon shutdown - Revisited

The problem - upon shutdown, filesystem /var cannot be unmounted because it
is busy.

I had run into this problem earlier at home and sort of resolved it by
re-installing Update 2 and not upgrading to the latest stuff. It turns out
that this was no real solution, as I installed Update 2 on two different
machines here at work and upgraded to the latest release. These were
identical machines. One was upgraded before the latest kernel, the other
after the latest kernel. On the first one, I was having problems with the X
windows through a KVM, and discovered the cause being some typedefs being
removed from some modules. I learned that RH had a fixed kernel and
installed that. The second upgrade included this kernel for Tao. The kernels
were supposedly the same, if that can be - one from Tao and the other RH.

So the only differences, I thought, were the kernels. But one was shutting
down cleanly, and the other not due to the busy filesystem.

Revisiting posts to the earlier emails sort of lead me through more
investigation as I now had machines I could compare with tools like lsof. I
discovered that one had audit log files open and the other didn't. Upon
further looking, I find that both machines had the audit module loaded. But
one machine, the failing one, had initscripts for audit, the other did not.

Upon turning the initscripts off for audit, the problem went away and has
not returned, and both machines still have the audit module loaded.

So, finally I get to my question. Where did the audit initscripts come from
for the second machine? I did use the yum.conf which had the
mirrored repositories on the second installed machine, so I'm guessing that
this may be the culprit. But the machine at home was upgraded with the
default yum.conf (the symlinked one) and it also had the problem filesystem,
but I can't guarantee that the initscripts were on this machine.

I am not a Linux guru, and wouldn't know where to start actually testing
this to resolve this. But I would like to ask someone who is more knowledged
than I if they might look into firstly, where the differences in the
upgrades might be occurring, and secondly, is this audit initscript thing
truly the problem.

I hope this helps anyone running into this problem in the future, as there
were others before me that butt heads with this.


Thanks, and sorry for the long booklet.

Steve Campbell
campbell-TtXmYh9KqR1Wk0Htik3J/[email protected]
Charleston Newspapers