how costly is flush = sync vs incremental?
i'm trying to figure out how costly it is to set flush=sync vs
incremental in auditd.conf. In theory, it would seem like it is more
expensive, but by how much? At what level of paranoia about not losing
audit logs does it make sense to use flush=sync or is it not much more
costly and one might as well use that setting?
Thoughts?