Re: Auditd hangs hard
On Tuesday 12 June 2007 04:50:27 Matthew Booth wrote:
> Does boosting the priority so auditd runs more often help? I
think it
> defalts to 3, you can make it 10 for an experiment.
Thanks, Steve. This put me on the right track. It turns out that not
only is LSF very noisy, but it also runs itself with niceness -20.
Renicing it to -5 and running auditd at -10 fixes the problem.
Good.
It does strike me that audit could cope with overload much better,
though.
It depends on how you have the configuration set. If you set disp_qos to
lossy, then it should have discarded packets sent to the dispatcher. The only
thing that it would be waiting on at that point is disk writing which has
several tunables, too. If the dispatcher was the limiting factor, you may
have to make it multi-threaded with one thread assigned to drain the auditd
interface and write it to a fifo where another thread writes to syslog. This
would allow the audit system to make better use of its time slice.
If it's configured to drop messages rather than kill the system,
it could probably disable auditing entirely when the kernel buffer is
full, and only re-enable it when there's enough space.
How big was the kernel buffer when you had problems? (Its adjustable.)
-Steve