From mboxrd@z Thu Jan  1 00:00:00 1970
From: Lev Olshvang <levonshe@yandex.com>
Subject: why I have lost messages on boot even with very big backlog while I
	hunting only 2 syscalls?
Date: Wed, 27 Sep 2017 23:41:29 +0300
Message-ID: <1381531506544889@web29j.yandex.ru>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
Received: from mx1.redhat.com (ext-mx04.extmail.prod.ext.phx2.redhat.com
	[10.5.110.28])
	by smtp.corp.redhat.com (Postfix) with ESMTPS id EA6608F3CA
	for <linux-audit@redhat.com>; Wed, 27 Sep 2017 20:41:34 +0000 (UTC)
Received: from forward106o.mail.yandex.net (forward106o.mail.yandex.net
	[37.140.190.187])
	(using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by mx1.redhat.com (Postfix) with ESMTPS id 679B4114C22
	for <linux-audit@redhat.com>; Wed, 27 Sep 2017 20:41:32 +0000 (UTC)
Received: from mxback11g.mail.yandex.net (mxback11g.mail.yandex.net
	[IPv6:2a02:6b8:0:1472:2741:0:8b7:90])
	by forward106o.mail.yandex.net (Yandex) with ESMTP id 10C3D782FE5
	for <linux-audit@redhat.com>; Wed, 27 Sep 2017 23:41:30 +0300 (MSK)
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: linux-audit <linux-audit@redhat.com>
List-Id: linux-audit@redhat.com

Hello list !

A very technical question
I have Ubuntu 16.10 Virtual Box , auditd 2.7.8
I have audit=1 parameter in grub.cfg
I see that /proc/cmdline indeed sees it

I see that auditd is started with PID 564
 
root       312     2  0 23:12 ?        00:00:00 [kauditd]
root       564     1  0 23:12 ?        00:00:00 /sbin/auditd

And I have 15 lost messages   ???
auditctl -s
enabled 1
failure 1
pid 564
rate_limit 0
backlog_limit 16384
lost 15
backlog 0
backlog_wait_time 30
loginuid_immutable 0 unlocked

auditctl -l
-a always,exit -F arch=b64 -S execve,execveat -F key=exec

Do I understand correctly that auiditd is indeed started by systemd  before other services, except 2 that is listed in auditd.service dependencuies - local-fs and some temp setup of systemd ?


Regards,
Lev