From mboxrd@z Thu Jan 1 00:00:00 1970 From: Paul Moore Subject: Re: [RFC][PATCH] audit: log join and part events to the read-only multicast log socket Date: Thu, 23 Oct 2014 15:08:04 -0400 Message-ID: <1919994.kBtqGod6UL@sifl> References: <30ef5c1ba42b52953e5684a0322975c3f0fadc77.1412706089.git.rgb@redhat.com> <35356560.bDSLJB7XGk@sifl> <54490E85.6020403@magitekltd.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <54490E85.6020403@magitekltd.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: LC Bruzenak Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Thursday, October 23, 2014 09:19:49 AM LC Bruzenak wrote: > On 10/22/2014 04:29 PM, Paul Moore wrote: > > Well, like I said, It's probably safer that way as the code will work > > regardless. Time to break bad habits :) > > I hear you. But there's working and there's working well. > As long as we don't suffer a search response degradation by changing the > assumptive order, as I said, I'm OK with going back and reworking code. > If it makes searching real data unusable, it's now broken some > operational stuff. Performance is a big deal, I think we've all been hearing that for some time now. I get it, and it is something that is and will remain *a* priority. However, this fixed ordering is something that is Just Plain Wrong and is likely to make life much more difficult for us as we try to improve audit. -- paul moore security and virtualization @ redhat