Re: [PATCH-RFC] POSIX Event Logging, kernel 2.5.6 & 2.4.18

Bernd Eckenfels
2002-03-13T01:11:15Z

In article <3C8E8912.64435C1E@us.ibm.com> you wrote:
> I assume that you mean do the nasty stuff but never have anything in
> your
> event log indicating that it happened. Good point, but if the buffer is
> sized appropriately for the incoming volume of events and the logging
> daemon
> is reading the events out of the kernel buffer (as should normally be
> the case),
> then you would see the events.

Well, depending on the type of events one can even think about a "halt" like
it is required for audit trail overflow.

What would be nice is a policy for each type of event:

- overwrite old/new/halt
- rate limit
- buffer size