I was going over the reasons recently why I changed austream from being an auditd dispatcher to being a replacement audit daemon. They amounted to: 1. No nice way to prevent a dispatcher from generating audit events 2. Additional context switching becomes significant under load 3. Not possible to run auditd at real time priority 4. The config file is ugly if you don't want to write to disk (1) is very bad, as it can cause a feedback loop which will eventually kill the machine. If you stare at it hard enough there are ways round it, but they're not pretty. (2) When you really hammer it, the dispatcher interface overhead becomes significant. In addition to the context switching you're also losing message separation, so you need to do your own buffering. (3) This is a problem if an application running at high priority generates a significant burst of audited events. No matter how big you make your buffers, if you produce faster than you consume you will eventually run out of space. In my testing the performance of the system when this happened was exceptionally poor (to the point of requiring a hard reset). (4) is not a strong reason in itself, but it highlights that auditd was designed for writing to disk above all other use cases. A while back I looked at Solaris's BSM, initially with a view to porting austream to Solaris. I noted that BSM has 'plugins' which are implemented as loadable modules[1]. It occurs to me that if auditd had the same, this would address points (1) and (2). (3) also becomes simpler and more robust once implemented, because you only have a single real time process. Point (4) can be addressed by refactoring existing output methods into plugins. I believe this would currently amount to a 'file' plugin and a 'dispatcher' plugin. If they aren't loaded, they wouldn't need to be unconfigured. Thoughts? Matt [1] See man audit_control(4) and audit_syslog(5) on a Solaris system. -- Matthew Booth, RHCA, RHCSS Red Hat, Global Professional Services M: +44 (0)7977 267231 GPG ID: D33C3490 GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490