On Thursday, March 30, 2017 11:40:31 AM EDT Fulda, Paul R [US] (MS) wrote: For one, you can set the flush mode in auditd.conf to INCREMENTAL_ASYNC and it should allow you to completely fill up your disks in a hurry without bogging down the system. Also set freq to something like 250. I would then take a look at the key report during that time to see what event is getting triggered. aureport --start xxx --end yyy --key --summary Where xxx is start of this burst and yyy is end of this burst. (More than likely its some rule watching deletes which is not very useful.) Once you know which rule is getting triggered I think we can talk about how to minimize the events. -Steve