From mboxrd@z Thu Jan 1 00:00:00 1970 From: LC Bruzenak Subject: Re: user message limits Date: Wed, 28 Jan 2009 11:44:27 -0600 Message-ID: <1233164667.30154.142.camel@homeserver> References: <1233100868.30154.103.camel@homeserver> <200901281215.16996.sgrubb@redhat.com> Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <200901281215.16996.sgrubb@redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Wed, 2009-01-28 at 12:15 -0500, Steve Grubb wrote: > ... > > Offhand, I don't remember why the kernel sets the limit so low. It could be > bumped some. How much, I don't know. 4K or 8K would seem fine. > > -Steve Thanks Steve! To me the primary thing is consistency with the input text size. Seems strange to successfully send in some data and be unable to retrieve it. A secondary concern is - what is the input limit? If the total input buffer size is 8K and some of that needs to be used internally (by audit lib), maybe it should be clamped at 7K? I'm trying to avoid a lot of retry logic on the sending side, where if a failure occurs, we would truncate and resend until it passes. I guess if I were certain that 7K is always going to fit I could artificially clamp my own input there, but it seems better if it were universally constant. Thx, LCB. -- LC (Lenny) Bruzenak lenny@magitekltd.com