Re: audit.log space requirements:

--- Michael C Thompson <mcthomps(a)us.ibm.com&gt; wrote: Pathnames tend to be the leading cause of large audit records on production Unix systems. It would be instructive to use a kernel make as an audit test case, if you're looking to understand the behavior of the audit system under a file system load. You can also use: % find / -type f to generate a pathname edgecase test. To really make the developers sweat try: % find / -type f & find / -type f & find / -type f I haven't been able to gleen what is being audited in the networking context. If there is audit of packet delivery (has been required on past CAPP and LSPP evaluations) turning that on and starting X11 will offer insights as well. Lots of fun to be had here! Casey Schaufler casey(a)schaufler-ca.com __________________________________ Discover Yahoo! Get on-the-go sports scores, stock quotes, news and more. Check it out! http://discover.yahoo.com/mobile.html