If the log rate of audit exceeds audit_rate_limit, audit_log_end will drop the audit logs. Printk before dropping them may be a better choice. Signed-off-by: Ecronic <ecronic(a)outlook.com&gt; --- kernel/audit.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/kernel/audit.c b/kernel/audit.c index a75978ae38ad..3f5be93447cb 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -2415,10 +2415,10 @@ void audit_log_end(struct audit_buffer *ab) if (!ab) return; - if (audit_rate_check()) { - skb = ab->skb; - ab->skb = NULL; + skb = ab->skb; + ab->skb = NULL; + if (audit_rate_check()) { /* setup the netlink header, see the comments in * kauditd_send_multicast_skb() for length quirks */ nlh = nlmsg_hdr(skb); @@ -2427,8 +2427,11 @@ void audit_log_end(struct audit_buffer *ab) /* queue the netlink packet and poke the kauditd thread */ skb_queue_tail(&audit_queue, skb); wake_up_interruptible(&kauditd_wait); - } else + } else { + kauditd_printk_skb(skb); + kfree_skb(skb); audit_log_lost("rate limit exceeded"); + } audit_buffer_free(ab); } -- 2.30.0