reactive audit question

Steve, others, I may have asked this before, but it is becoming an issue so I thought I'd check again anyway. In our systems there are occasionally AVC "storms" which happen as a result of some unforeseen (and often unknown) issue tickled by various reasons. At fielded sites, we are unable to fix this easily. Since we have to keep all the audit data, this leads to many problems on a system running over a weekend, for example, with no administrators around. I probably need to add in either some rate-limiting code or possibly kill off the process generating the AVCs. Rate-limiting I'd guess could go into the auditd. If I wanted to be more brutal and kill the process, I'd think maybe a modification to the setroubleshoot code would be workable. I don't think that a reactive rule is an option - 1) We have our rules locked into the kernel on startup and I'm against changing that, and 2) maybe "normal" avc counts, under a threshold, we'd still want to see, from that same process. Besides, 3) unless the rules have been changed, we cannot exclude AVCs from a particular type/process anyway. Got any thoughts/ideas/advice? Thx, LCB -- LC (Lenny) Bruzenak lenny(a)magitekltd.com