From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: [PATCH] Add auditd listener and remote audit protocol Date: Thu, 14 Aug 2008 20:04:30 -0400 Message-ID: <200808142004.31091.sgrubb@redhat.com> References: <200808142143.m7ELh0MP028560@greed.delorie.com> <200808142216.m7EMGILI029666@greed.delorie.com> <1218756409.7022.255.camel@homeserver> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1218756409.7022.255.camel@homeserver> Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Thursday 14 August 2008 19:26:49 LC Bruzenak wrote: > My one auditd machine gets very busy occasionally - I sometimes drop > events (rather than abort for a development machine) even after > ratcheting up my event queue to 8K. I believe that this is a problem in the audit code. The scheduler changed sometimes around 2.6.25 and I started seeing it when I hadn't previously. I have a real strong idea what the problem is after talk with Chris Wright about it, but am at a loss for how to make it better. I hope to address this in the coming days since adding more load to auditd will make it worse. > Now the question is what happens if the network hiccups and I cannot > send the events from a client? There will be a couple admin defined actions just like when disk logging has problems. Anyone that wants to enhance what is in this first cut, please send patches. > I could still write the events to the local disk, but them getting them onto > the intended aggregator is now tricky right? Will the sender keep track of > the last event sent and recover once the connection is restored? At first, I think a best effort solution is what we'll have. IPA's delivery service will be a more robust solution with failover capabilities. I do not envision going to that length with auditd. -Steve