Re: FreeBSD 14.3 auditd Zombie Issue (Bug #295840 ) — Request for Direct Technical Alignment

(Dropping freebsd-bugs@ and freebsd-security@ to BCC, because this kind of communication shouldn't really go there)

On 6/22/26 02:40, Anuj Telkhade wrote:
> Hi Team,
> 

Hello!

> We are observing an issue on FreeBSD 14.3 where auditd appears to accumulate zombie child processes during frequent audit trail rotation. The issue is seen on systems with high audit event volume and relatively small audit trail file size configuration. Under this condition, audit trail files rotate frequently. Each rotation appears to invoke /etc/security/audit_warn with the closefile argument. Over time, multiple audit_warn processes remain in a defunct/zombie state.
> 
> Please check more details on this reference ticket - 295840 – Accumulation of zombie processes on FreeBSD 14.3 systems during sustained high-volume audit trail rotation on vendor machines <https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295840>,
> > To expedite troubleshooting we need freeBSD team's regular calls and direct alignment with Qualys team for solution.
> 
> Let us know your convenient time to sync up.> 
I'm sorry that we haven't been able to figure out what's happening in your scenario yet, but this isn't really how the FreeBSD project works.  The mailing list and bugzilla are both directed to folks largely working on a volunteer basis.  Some bugs do see some sponsored effort for reasons that aren't always broadcasted, but interactive support isn't something that the project is able to provide regularly- this is why companies like Klara[0] exist to fill in the gaps.

Some of the commits against your PR have been sponsored by Klara because we've done previous work in the OpenBSM space and I was able to secure us some time to work on this, but I can't really justify more synchronous debugging efforts at the expense of our paid engagements.  You're welcome to reach out to us if you'd like to work out a different arrangement, or we're more than happy to continue assisting as time allows.

To expand on the latest instructions from the PR: the point is to stop auditd and run it under ktrace exclusively until you've collected a number of zombies while tracing, then stop it and provide us with the relevant trace and logs.  From that, we can gain a better understanding of the event sequencing that's leading to auditd failing to reap the zombies.

Thanks,

Kyle Evans

[0] https://klarasystems.com/