Re: /var/log/messages: backlog limit exceeded
On Mon, 2005-06-20 at 10:50 +0100, David Woodhouse wrote:
Assuming this approach is satisfactory we may want to look for more
callers which can be converted to audit_log_start_wait(), and perhaps
give a few more slots to the atomic callers, so there's always space
for them.
Something like this...
--- kernel-2.6.9/linux-2.6.9/kernel/audit.c 2005-06-20 16:12:48.000000000 +0100
+++ kernel-2.6.9-running/linux-2.6.9/kernel/audit.c 2005-06-20 16:18:37.000000000 +0100
@@ -449,7 +449,7 @@ static int audit_receive_msg(struct sk_b
return -ESRCH;
if (audit_enabled && audit_filter_user(tsk, msg_type)) {
- ab = audit_log_start(NULL, msg_type);
+ ab = audit_log_start_wait(NULL, msg_type);
if (ab) {
audit_log_format(ab,
"user pid=%d uid=%u auid=%u msg='%.1024s'",
@@ -707,7 +707,7 @@ struct audit_buffer *__audit_log_start(s
return NULL;
while (audit_backlog_limit
- && skb_queue_len(&audit_skb_queue) > audit_backlog_limit) {
+ && skb_queue_len(&audit_skb_queue) > audit_backlog_limit +
wait?0:5) {
if (wait) {
int ret = 1;
/* Wait for auditd to drain the queue a little */
--
dwmw2