From: Steve Grubb <sgrubb@redhat.com>
To: linux-audit@redhat.com
Subject: Re: mode = forward
Date: Mon, 30 Jul 2012 10:14:18 -0400 [thread overview]
Message-ID: <29212133.i3iilqqluk@x2> (raw)
In-Reply-To: <1343524923.2542.18.camel@debian.domain_name>
On Saturday, July 28, 2012 09:22:03 PM Michael Mather wrote:
> I am using Ubuntu 12.04, which uses version 1.7.18 of auditd.
>
> Audispd is complaining that the queue is full and it is dropping events.
This means you have a plugin that is not pulling events fast enough. Are you
boosting the priority so that it gets more time slices? What plugins are you
using?
You also want to increase the queue size if you have a busy system. And if you
have increased the size and and boosted priority, then perhaps you have rules
that collect too much information.
> According to the man page for audisp-remote.conf (as found at
> linux.die.net), the parameter "mode" can be set to "immediate" or
> "forward". "forward" means that events are buffered in a queue.
Forward means that it puts the event to a cache on disk and then tries to send
it. Immediate means no queuing - it just tries to send.
> I found that "mode" was set to "immediate", and the queue did not exist.
>
> But when I try to set the value as "forward" and restart auditd,
> audisp-remote complains that "Option forward not found". And the queue
> still gets full.
1.7.18 is a much older version of the audit system. It may not have all the
features of the current software.
> Last October, Steve was writing about how big the queue might be on this
> very site.
>
> Can someone explain what is going on?
If it does not recognize the forward option, then that feature is not
available on the older software. There is a 1.8 release where this is
"supported". But the 1.8 code is not being actively developed.
-Steve
prev parent reply other threads:[~2012-07-30 14:14 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-07-29 1:22 mode = forward Michael Mather
2012-07-30 13:17 ` Marcelo Cerri
2012-07-30 14:00 ` Michael Mather
2012-07-30 14:24 ` Steve Grubb
2012-07-30 18:50 ` Michael Mather
2012-07-30 14:14 ` Steve Grubb [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=29212133.i3iilqqluk@x2 \
--to=sgrubb@redhat.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox