Re: Fw: Audit record emission
On Thursday 05 May 2005 17:34, Chris Wright wrote:
I always get drops with the following simple setup (default
auditd.conf):
<snip>
It's pathological, but always overloads the system which is
useful for
testing.
FWIW, I ran this for hours and had no lost messages. I tested with a backlog
of 1024 & priority_boost of 3.
-Steve