On 13/12/26, Aaron Lewis wrote: > Hi, > > I'm doing a stress test on auditd, so I add a rule to monitor "open" > syscall, then I use a c program to generate massive amount of logs. > The program finished and exited. > > But I generated too much, if I kill auditd and start it again, I can > still see a lot of type=SYSCALL logs. (But not CWD or PATH) > > Can I clear the existing buffer? Did you remove the rule that caused the massive amount of logging? Auditd will drain that buffer. The default is a queue of 64 messages, which should drain reasonably quickly if the rule has been removed and the queue length hasn't been overridden to a huge value. Otherwise, there is no other way to drain that buffer. > Aaron Lewis - PGP: 0xDFE6C29E ( http://keyserver.veridis.com ) - RGB -- Richard Guy Briggs <rbriggs(a)redhat.com&gt; Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat Remote, Ottawa, Canada Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545

On Tuesday, January 14, 2014 01:09:52 PM Aaron Lewis wrote: > Yes, I did run auditctl -D to clear all rules. And during testing I > have enlarged the buffer queue to 10240 messages. > > Did you mean that once -D is issued, the buffer will be cleared by > auditd, but not by linux kernel? There is no way to directly clear the in kernel buffer. The audit system is supposed to keep events for disposition. If there was a simple command to dump events, that would be a simple way to circumvent detection. So, the best way to drain the queues is to give auditd more priority so it runs more often and longer before its time slice is up. You don't need to log to disk. But something has to read the events to get them out.

-Steve