audit_backlog_limit messages

Steve Grubb sgrubb at redhat.com
Thu Jun 30 19:23:47 UTC 2005


On Thursday 30 June 2005 13:11, David Woodhouse wrote:
> That's a bandaid which I've implemented for now in order to find the
> offending code, but which probably shouldn't be included long-term...

yes bandaid...but this seems to have a history of rearing its ugly head. If it 
auditd ever does get on the wait queue, the game is over. You can add this as 
a bugon or runtime check, but I'd keep it because the consequences are bad 
when it does happen.

-Steve




More information about the Linux-audit mailing list