From mboxrd@z Thu Jan 1 00:00:00 1970 From: Richard Guy Briggs Subject: Re: [PATCH] audit: allow unlimited backlog queue Date: Wed, 15 Jan 2014 11:50:11 -0500 Message-ID: <20140115165011.GB23261@madcap2.tricolour.ca> References: <1389740356-18867-1-git-send-email-rgb@redhat.com> <1436512.jO6G90Soyo@x2> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Content-Disposition: inline In-Reply-To: <1436512.jO6G90Soyo@x2> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On 14/01/15, Steve Grubb wrote: > On Tuesday, January 14, 2014 05:59:16 PM Richard Guy Briggs wrote: > > Since audit can already be disabled by "audit=0" on the kernel boot line, or > > by the command "auditctl -e 0", it would be more useful to have the > > audit_backlog_limit set to zero mean effectively unlimited (limited only by > > system resources). > > I don't see a useful purpose to this. That's up to you. On your side it is a documentation question. It is already implemented in the kernel. The rationale I thought was fairly clear. The flexibility is there. A warning would be useful. > -Steve - RGB -- Richard Guy Briggs Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat Remote, Ottawa, Canada Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545