From mboxrd@z Thu Jan  1 00:00:00 1970
From: Steve Grubb <sgrubb@redhat.com>
Subject: Re: Audit slowing system.
Date: Thu, 5 May 2011 08:47:05 -0400
Message-ID: <201105050847.05353.sgrubb@redhat.com>
References: <OFF8A9DBD7.816BA486-ON85257886.006B5900-85257886.006C2645@us.ibm.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <OFF8A9DBD7.816BA486-ON85257886.006B5900-85257886.006C2645@us.ibm.com>
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On Wednesday, May 04, 2011 03:41:09 PM David Flatley wrote:
>     RHEL 4.7 system running Steve Grubb's STIG compliant audit.rules file. 
> System seems to be struggling to run audit. I run this
> config on several systems with no problems. Top does not show anything 
> that indicates a problem, no directories filling. Any 
> suggestions on settings to change? It is a 64 bit system with the 32 bit 
> rules commented out in the rules file.

Are you getting lots of audit events logged? If so, that might point towards a rule 
that might need adjusting. Also, stig rules were never shipped (or tested) on RHEL4. 
So, I don't know which ones you are using. If the rules do not explicitly add the -F 
arch=b64 on the 64 bit rules, that would cause problems.

-Steve