Re: Events lost with dispatcher
On 31/03/10 20:56, Steve Grubb wrote:
Wait, you are writing a dispatcher...are you boosting your priority
above
auditd? If not, you should probably increase it by at least 4. Your dispatcher
has to stay ahead of auditd.
On a related note, has there been any more thought about loading
dispatchers into auditd itself as dynamic libraries? This would solve
this problem, and also the issue of accidentally writing a rule which is
triggered by a dispatcher, causing a DOS.
Matt
--
Matthew Booth, RHCA, RHCSS
Red Hat Engineering, Virtualisation Team
M: +44 (0)7977 267231
GPG ID: D33C3490
GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490