From mboxrd@z Thu Jan 1 00:00:00 1970 From: LC Bruzenak Subject: Re: Audit slowing system. Date: Thu, 05 May 2011 11:02:47 -0500 Message-ID: <1304611367.2033.12.camel@lcb> References: <201105050847.05353.sgrubb@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (ext-mx12.extmail.prod.ext.phx2.redhat.com [10.5.110.17]) by int-mx02.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id p45G2wxU009597 for ; Thu, 5 May 2011 12:02:58 -0400 Received: from webserver.magitekltd.com (rrcs-24-242-137-197.sw.biz.rr.com [24.242.137.197]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id p45G2tFe029856 for ; Thu, 5 May 2011 12:02:55 -0400 In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: David Flatley Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com You generally should start with an aureport over the time period you saw the issue, then drill down from there. But if your audit logs are not larger than usual maybe this isn't your problem. What symptoms of struggling are you seeing? You said top shows nothing out of the ordinary and no directories are getting full (I suppose you mean /var/log/audit)...so I am not certain what behavior you see that is leading you towards audit being the problem. LCB -- LC (Lenny) Bruzenak lenny@magitekltd.com