Re: overhead of auditd
On Monday, July 15, 2019 6:21:11 AM EDT 杨海 wrote:
I ever read the document you wrote about laying IDS on top of auditd.
And I
suppose inotify could be lightweight for IDS. Any comment?
Yes, audit works fine for IDS work. But one would not audit all syscalls for
every program. That will kill your system. You have to be selective about
what you are auditing.
-Steve
------------------ Original ------------------
From: "Steve Grubb"<sgrubb(a)redhat.com>;
Date: Fri, Jul 12, 2019 08:14 PM
To: "linux-audit"<linux-audit(a)redhat.com>;
Cc: "杨海"<hai.yang(a)magic-shield.com>;
Subject: Re: overhead of auditd
Hello,
On Thursday, July 11, 2019 11:23:45 PM EDT 杨海 wrote:
> Turning on all system calls in audit.rules, and transferring a tar file
> to the target system (CentOS 7, 4 cores), I found "auditd" consumes
> high CPU usage. Is it expected?
It would not be surprising. Some system calls have more overhead than
others. So, depending on everything that is running, you can kill your
system.
> BTW, after turning write-logs off, and add dispatcher, both "audispd"
> and "auditd" are consuming high CPU.
They have a lot of events to handle.