Here is an error message logged in /var/log/user.log and found on a linux box running Ubuntu 9.10

auditd: /sbin/audispd permissions should be 0750

Auditd is a daemon which belongs to the auditd package. This package contains a bunch of user utilities to store and analyze all what it is being logged by the audit subsystem in the Linux 2.6 kernel.

The only thing to do for this release version of Ubuntu :

root@localhost:~# ls -l /sbin/audispd
-rwxr-xr-x 1 root root 96020 2009-09-10 00:52 /sbin/audispd

root@veronique-desktop:~# ls -l /sbin/audispd
-rwxr-x— 1 root root 96020 2009-09-10 00:52 /sbin/audispd

root@veronique-desktop:~# dpkg-reconfigure auditd
update-rc.d: warning: auditd start runlevel arguments (S) do not match LSB Default-Start values (2 3 4 5)
update-rc.d: warning: auditd stop runlevel arguments (0 6) do not match LSB Default-Stop values (0 1 6)

While using mondorescue to perform a full backup of a server running RHEL 5, here is a list of error messages found in /var/log/mondoarchive.log :

File descriptor 3 (/tmp/mojo-jojo.blah.qN83BE) leaked on lvm invocation. Parent PID 3006: /bin/bash
File descriptor 3 (/tmp/mojo-jojo.blah.qN83BE) leaked on lvm invocation. Parent PID 3049: /bin/bash
File descriptor 3 (/tmp/mojo-jojo.blah.qN83BE) leaked on lvm invocation. Parent PID 3109: /bin/bash
File descriptor 3 (/tmp/mojo-jojo.blah.qN83BE) leaked on lvm invocation. Parent PID 3129: /bin/bash
File descriptor 3 (/tmp/mojo-jojo.blah.qN83BE) leaked on lvm invocation. Parent PID 3196: /bin/bash
File descriptor 3 (/tmp/mojo-jojo.blah.qN83BE) leaked on lvm invocation. Parent PID 3268: /bin/bash
File descriptor 3 (/tmp/mojo-jojo.blah.qN83BE) leaked on lvm invocation. Parent PID 3326: /bin/bash
File descriptor 3 (/tmp/mojo-jojo.blah.qN83BE) leaked on lvm invocation. Parent PID 3385: /bin/bash
File descriptor 3 (/tmp/mojo-jojo.blah.qN83BE) leaked on lvm invocation. Parent PID 3450: /bin/bash
File descriptor 3 (/tmp/mojo-jojo.blah.qN83BE) leaked on lvm invocation. Parent PID 3512: /bin/bash
File descriptor 3 (/tmp/mojo-jojo.blah.qN83BE) leaked on lvm invocation. Parent PID 3574: /bin/bash
File descriptor 3 (/tmp/mojo-jojo.blah.qN83BE) leaked on lvm invocation. Parent PID 3631: /bin/bash
File descriptor 3 (/tmp/mojo-jojo.blah.qN83BE) leaked on lvm invocation. Parent PID 3687: /bin/bash
File descriptor 3 (/tmp/mojo-jojo.blah.qN83BE) leaked on lvm invocation. Parent PID 3749: /bin/bash
File descriptor 3 (/tmp/mojo-jojo.blah.qN83BE) leaked on lvm invocation. Parent PID 3805: /bin/bash
File descriptor 3 (/tmp/mojo-jojo.blah.qN83BE) leaked on lvm invocation. Parent PID 3861: /bin/bash

After googling a little bit, here is the first explanation I managed to find. It seems that the lvm utility inherited all the opened file descriptors from the shell where it was launched.

By default, only three file descriptors are opened : 0 standard input,  1 standard output and 2 error output. So, a file descriptor named 3 was opened by a program but not closed properly.

A similar bug was reported within the official Debian bugreport :

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=466138