[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: audit.log space requirements:

--- Michael C Thompson <mcthomps us ibm com> wrote:

> To begin the space-requirements discussion:

Pathnames tend to be the leading cause of large
audit records on production Unix systems. It
would be instructive to use a kernel make as
an audit test case, if you're looking to
understand the behavior of the audit system
under a file system load.

You can also use:
    % find / -type f
to generate a pathname edgecase test.
To really make the developers sweat try:
    % find / -type f & find / -type f & find / -type f

I haven't been able to gleen what is being
audited in the networking context. If there
is audit of packet delivery (has been required
on past CAPP and LSPP evaluations) turning
that on and starting X11 will offer insights
as well.

Lots of fun to be had here!

Casey Schaufler
casey schaufler-ca com

Discover Yahoo! 
Get on-the-go sports scores, stock quotes, news and more. Check it out! 

[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]