From mboxrd@z Thu Jan 1 00:00:00 1970 From: Michael Mather Subject: mode = forward Date: Sat, 28 Jul 2012 21:22:03 -0400 Message-ID: <1343524923.2542.18.camel@debian.domain_name> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (ext-mx13.extmail.prod.ext.phx2.redhat.com [10.5.110.18]) by int-mx09.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id q6T1LxKR007725 for ; Sat, 28 Jul 2012 21:21:59 -0400 Received: from ironport2-out.teksavvy.com (ironport2-out.teksavvy.com [206.248.154.182]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id q6T1LwWY024710 for ; Sat, 28 Jul 2012 21:21:58 -0400 List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com I am using Ubuntu 12.04, which uses version 1.7.18 of auditd. Audispd is complaining that the queue is full and it is dropping events. According to the man page for audisp-remote.conf (as found at linux.die.net), the parameter "mode" can be set to "immediate" or "forward". "forward" means that events are buffered in a queue. I found that "mode" was set to "immediate", and the queue did not exist. But when I try to set the value as "forward" and restart auditd, audisp-remote complains that "Option forward not found". And the queue still gets full. Last October, Steve was writing about how big the queue might be on this very site. Can someone explain what is going on? Thanks - Michael ----------------