Re: Fw: Audit record emission
* Linda Knippers (linda.knippers(a)hp.com) wrote:
I can usually, but not always, reproduce record loss with a program
similar to one of Kris' tests, but with fewer than 200 iterations.
I haven't tried fooling with the auditd.conf parameters yet, so I
was curious about the stress.conf file.
I always get drops with the following simple setup (default auditd.conf):
$ sudo auditctl -a entry,always -S open -F uid=23
$ sudo -u '#23' bash
$ while :; do < /dev/null; done
It's pathological, but always overloads the system which is useful for
testing.
thanks,
-chris