Re: [PATCH] ratelimit printk messages from the audit system

Eric Paris wrote: > On Wed, 2008-01-23 at 16:05 -0500, Linda Knippers wrote: >> This is unrelated to your patch but I think it would be nice if >> audit_lost represented the number of audit messages lost since the >> last time the message came out or the last time an audit record >> came out. Today its a cumulative count since the system was >> booted. Is it too much overhead to zero it? > > Shouldn't be too much overhead, we are already on a slow/unlikely > path. What's the benefit though? Just don't want to have to do a > subtraction? Well that, plus if the system is up for a long time (which we hope) and the message is infrequent (which we also hope), then it could take me a while to find the previous message in order to do the subtraction. > If we are dropping the 'we lost some messages' message 0'ing the > counter at that time would be a bad idea, certainly not unsolvable, > but I don't see what it buys us. I wouldn't want to lose the message, just make it more useful. And if we zero it we don't have to worry about it wrapping. As it is now, its really just the count since the last time it wrapped.