From: Max Englander <max.englander@gmail.com>
To: Paul Moore <paul@paul-moore.com>
Cc: Richard Guy Briggs <rgb@redhat.com>, linux-audit@redhat.com
Subject: Re: [PATCH] audit: optionally print warning after waiting to enqueue record
Date: Thu, 25 Jun 2020 03:34:56 +0000 [thread overview]
Message-ID: <20200625033455.GA2576@linux-kernel-dev> (raw)
In-Reply-To: <CAHC9VhSWsX5bYX2oGhEsmWTQVk6F7S3JxJi0tmjUEo3sStXbPw@mail.gmail.com>
On Tue, Jun 23, 2020 at 08:15:59PM -0400, Paul Moore wrote:
> On Thu, Jun 18, 2020 at 8:30 PM Richard Guy Briggs <rgb@redhat.com> wrote:
> > On 2020-06-18 23:48, Max Englander wrote:
> > > In case you’re any more receptive to the idea, I thought I’d mention
> > > that the need this patch addresses would be just as well fulfilled if
> > > wait times were reported in the audit status response along with other
> > > currently reported metrics like backlog length and lost events. Wait
> > > times could be reported as a cumulative sum, a moving average, or in
> > > some other way, and would help directly implicate or rule out backlog
> > > waiting as the cause in the event that an admin is faced with debugging
> > > degraded kernel performance. It would eliminate the need for a new flag,
> > > and fit well with the userspace tooling approach you suggested above.
> >
> > Such as is captured in this upstream issue from 3 years ago:
> >
> > https://github.com/linux-audit/audit-kernel/issues/63
> > "RFE: add kernel audit queue statistics"
>
> I would be more open to the idea of reporting queue statistics as part
> of the audit status information, or similar.
>
> --
> paul moore
> www.paul-moore.com
Excellent, I'll send a v2 patch.
--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
next prev parent reply other threads:[~2020-06-25 3:35 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-06-16 4:58 [PATCH] audit: optionally print warning after waiting to enqueue record Max Englander
2020-06-17 18:47 ` Paul Moore
2020-06-17 22:54 ` Max Englander
2020-06-18 1:06 ` Paul Moore
2020-06-18 23:48 ` Max Englander
2020-06-19 0:30 ` Richard Guy Briggs
2020-06-24 0:15 ` Paul Moore
2020-06-25 3:34 ` Max Englander [this message]
2020-06-18 13:39 ` Steve Grubb
2020-06-18 13:46 ` Paul Moore
2020-06-18 14:36 ` Steve Grubb
2020-06-18 16:29 ` Paul Moore
2020-06-18 22:57 ` Max Englander
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200625033455.GA2576@linux-kernel-dev \
--to=max.englander@gmail.com \
--cc=linux-audit@redhat.com \
--cc=paul@paul-moore.com \
--cc=rgb@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox