On Thu, 26 Dec 2013 11:58:32 +0800 Aaron Lewis <the.warl0ck.1989(a)gmail.com&gt; wrote: The audit daemon only keeps one event "in flight" until its consumed by all sources. This is partly a limitation imposed by CC requirements that loss of audit capability have a known limit on potentially lost events. Generally it gets rid of events quickly. One question to ask would be if auditd is writing to disk? If so, maybe changing the writeback scheme would help. Besides that, you can change the priority of auditd and/or the dispatcher. -Steve