Re: Auditd hangs hard

It depends on how you have the configuration set. If you set disp_qos to lossy, then it should have discarded packets sent to the dispatcher. The only thing that it would be waiting on at that point is disk writing which has several tunables, too. If the dispatcher was the limiting factor, you may have to make it multi-threaded with one thread assigned to drain the auditd interface and write it to a fifo where another thread writes to syslog. This would allow the audit system to make better use of its time slice.

> If it's configured to drop messages rather than kill the system, > it could probably disable auditing entirely when the kernel buffer is > full, and only re-enable it when there's enough space. How big was the kernel buffer when you had problems? (Its adjustable.)