Starting sec with /etc/default/sec untouched causes sec to write to
syslog for example every time a rule creates a context. This may cause
another context to get created. So sec wrote > 400GB syslog in 24h at my
system making it unusable.

From the sec.pl manpage:

"Warning: be careful with this option if you use SEC  for  monitoring
syslog logfiles, because it might create message loops (SEC log messages
are written to SEC input files that trigger new log messages)."

Resolution: delete the "syslog=daemon" in /etc/default/sec

tags 694534 + patch
thanks

Hi

Patch to fix the problem.

Regards.

Hi,

I'm downgrading this bug:

The package doesn't create any rules. It doesn't start by default and it
doesn't create /etc/sec.conf (which is used in /etc/default/sec and needed for
sec to run). It doesn't even provide an example sec.conf. So if you want to
use is, you have to read the documentation and create the configuration
yourself. If you do that in a way that creates a problem, that might be a bug,
but not a critical one.

Cheers,

Ivo

Hi Niels,

I'd like to propose sec as a potential candidate for removal from
testing.  I applied the proposed patch for #694534 and builded the
package.  When doing so I noticed two lintian errors

E: sec: init.d-script-missing-dependency-on-remote_fs etc/init.d/sec: required-start
E: sec: init.d-script-missing-dependency-on-remote_fs etc/init.d/sec: required-stop

and I need to admit that I'm not up for ignoring such kind of errors and
thus I will not push the NMU I planed to do.

The package has no reverse dependencies.

Kind regards

        Andreas.

I do admit here that the default configuration does give gun pointed
straight
to foot. However at the moment there's no clear way with sec to filter or
detect
loops, which makes robust defaults hard to build. Single shot loop test in
startup would be better than anything. I'll have to investigate the
options.

This is one of the reasons why there's no sec.conf by default.