Re: why I have lost messages on boot even with very big backlog while I hunting only 2 syscalls?
On Sat, Sep 30, 2017 at 10:03 AM, Steve Grubb <sgrubb(a)redhat.com> wrote:
Maybe adjust your freq from 20 to maybe 50. Other than that, I
don't know of
any other user space tricks to improve the flow rate. Maybe Paul or Richard
has ideas. I see you have a 4.8 kernel. I think I remember there being some
netlink comm issues prior to 4.12.
Sorry for the delay in responding, I was doing a bit of traveling.
I would suggest trying a newer kernel if possible. Starting with
v4.10 and continuing up through v4.13 there was substantial work done
that would affect the audit backlog and kernel/auditd connection; if
you can try a v4.13 Linux kernel I would highly recommend it.
--
paul moore
www.paul-moore.com