Re: Occasional delayed output of events

On Mon, 2021-01-25 at 18:53 -0500, Steve Grubb wrote: > On Saturday, January 23, 2021 5:55:44 PM EST Burn Alting wrote: > > > > How is the following for a way forward. > > > > a. I will author a patch to the user space code to correctly parse > > > > this > > > > condition and submit it on the weekend. It will be via a new > > > > configuration item to auditd.conf just in case placing a fixed > > > > extended timeout (15-20 secs) affects memory usage for users of the > > > > auparse library. This solves the initial problem of > > > > ausearch/auparse > > > > failing to parse generated audit.b. I am happy to instrument what > > > > ever > > > > is recommended on my hosts at home (vm's and bare metal) to provide > > > > more information, should we want to 'explain' the occurrence, given > > > > I > > > > see this every week or two and report back. > > > > > > Seems reasonable to me. > > > > I can implement the 'end_of_event_timeout' change either as > > i. a command line argument to ausearch/aureport (say --eoetmo secs) and > > a > > new pair of library functions within the auparse() stable (say > > auparse_set_eoe_timeout() and auparse_get_eoe_timeout()) > > or > > ii. a configuration item in /etc/audit/auditd.conf, or > > > > > > Which is your preference? Mine is i. as this is a user space processing > > change, not a demon change. > > To be honest, I'm not entirely sure what we're seeing. I run some tests > today on my system. It's seeing issues also. I'd still like to treat the > root cause of this. But we do need to change the default. That I what > I'm trying to figure out. > > Back to your question, I'm wondering if we should do both? A changeable > default in auditd.conf and an override on the command line. So far, all items in /etc/audit/auditd.conf appear to only affect the daemon. Is this the right location to start adding non-daemon configuration items? (I accept there is no other place).

Happy to do both, if required. > -Steve