Fw: Audit record emission

[Chris Wright]

* Steve Grubb (sgrubb at redhat.com) wrote:
> On Thursday 05 May 2005 17:34, Chris Wright wrote:
> > I always get drops with the following simple setup (default auditd.conf):
> <snip>
> > It's pathological, but always overloads the system which is useful for
> > testing.
> 
> FWIW, I ran this for hours and had no lost messages. I tested with a backlog 
> of 1024 & priority_boost of 3.

Good to know.  I've always left the backlog at 64 (but then again, I was
usually trying to trigger the overflow).

thanks,
-chris