From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: [PATCH] Audit: save audit_backlog_limit audit messages in case auditd comes back Date: Thu, 27 Mar 2008 17:50:08 -0400 Message-ID: <200803271750.09037.sgrubb@redhat.com> References: <1206653864.2878.19.camel@localhost.localdomain> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <1206653864.2878.19.camel@localhost.localdomain> Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Eric Paris Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Thursday 27 March 2008 17:37:44 Eric Paris wrote: > This is useful to collect audit messages during bootup and even when au= ditd > is stopped. =C2=A0This is NOT a reliable mechanism, it does not ever ca= ll > audit_panic, nor should it.=20 Thanks Eric for working on this. We've needed this for quite a while so t= hat=20 we can see some of the avcs that happen during boot. > If auditd never starts the kernel will hold by default up to 64 message= s > in memory forever. I have an idea. Maybe this behavior could be enabled if audit=3D1 is pass= ed as a=20 boot parameter. In this way, you would know that the user intended for th= e=20 audit daemon to start at some point. You could then call audit panic or=20 whatever else is normal. If no audit=3D1 is passed, you could just do the= =20 printk like usual and not waste memory. Would this be helpful? Thanks, -Steve