From mboxrd@z Thu Jan 1 00:00:00 1970 From: Matthew Booth Subject: Volume of audit messages Date: Sun, 28 Jan 2007 22:01:40 +0000 Message-ID: <1170021700.3753.29.camel@localhost.localdomain> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============1644672735==" Return-path: Received: from [192.168.250.101] (sebastian-int.corp.redhat.com [172.16.52.221]) by pobox.surrey.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id l0SM1XTP000393 for ; Sun, 28 Jan 2007 22:01:33 GMT List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com --===============1644672735== Content-Type: multipart/alternative; boundary="=-sATNHFZTkwRBBBxQoslP" --=-sATNHFZTkwRBBBxQoslP Content-Type: text/plain Content-Transfer-Encoding: 7bit I'm considering turning on some fairly severe auditing. In addition to the usual suspects, the following are under consideration: 1. All opens for write 2. All execs 3. All incoming and outgoing network connections Has anybody tried the above on: * An idle system * A system running a moderately busy Oracle RAC node * A system running WebLogic If so, I'd be interested in what sort of volume of data we're talking about. I'd also be interested in any potted recipes for achieving (3) above that anybody might have ;) Thanks, Matt -- Red Hat, Global Professional Services M: +44 (0)7977 267231 GPG ID: D33C3490 GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490 --=-sATNHFZTkwRBBBxQoslP Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 7bit I'm considering turning on some fairly severe auditing. In addition to the usual suspects, the following are under consideration:

1. All opens for write
2. All execs
3. All incoming and outgoing network connections

Has anybody tried the above on:

* An idle system
* A system running a moderately busy Oracle RAC node
* A system running WebLogic

If so, I'd be interested in what sort of volume of data we're talking about. I'd also be interested in any potted recipes for achieving (3) above that anybody might have ;)

Thanks,

Matt
-- 
Red Hat, Global Professional Services

M:       +44 (0)7977 267231
GPG ID:  D33C3490
GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490
--=-sATNHFZTkwRBBBxQoslP-- --===============1644672735== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============1644672735==--