On Saturday, January 23, 2021 5:55:44 PM EST Burn Alting wrote:

How is the following for a way forward.

a. I will author a patch to the user space code to correctly parse this

condition and submit it on the weekend. It will be via a new

configuration item to auditd.conf just in case placing a fixed

extended timeout (15-20 secs) affects memory usage for users of the

auparse library. This solves the initial problem of ausearch/auparse

failing to parse generated audit.b. I am happy to instrument what ever

is recommended on my hosts at home (vm's and bare metal) to provide

more information, should we want to 'explain' the occurrence, given I

see this every week or two and report back.

Seems reasonable to me.

I can implement the 'end_of_event_timeout' change either as

i. a command line argument to ausearch/aureport (say --eoetmo secs) and a

new pair of library functions within the  auparse() stable (say

auparse_set_eoe_timeout() and auparse_get_eoe_timeout())

or

ii. a configuration item in /etc/audit/auditd.conf, or

Which is your preference? Mine is i. as this is a user space processing

change, not a demon change.

To be honest, I'm not entirely sure what we're seeing. I run some tests today 

on my system. It's seeing issues also. I'd still like to treat the root cause 

of this. But we do need to change the default. That I what I'm trying to 

figure out.

Back to your question, I'm wondering if we should do both? A changeable 

default in auditd.conf and an override on the command line.

-Steve