[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: altering audit_log_start



On Wednesday 16 March 2005 12:58, Timothy R. Chavez wrote:
> Any opinions on the matter?

It fails for 2 reasons, out of memory and backlog limit. If you're out of 
memory, there's not much you can do. If you hit the backlog limit, there's 
still not much you can do. 

Before the flow of control is back in the caller, it will consult 
audit_failure and either panic, print a message, or ignore it. In a CAPP 
setting, I think they will be running in panic mode. Any lost message is a 
problem.

So, if you get a failure returned, they are either in print or ignore mode. In 
either case, they have chosen to live with lost messages.

Out of curiosity...what would you do to handle the backlog limit?

-Steve


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]