user message limits

LC Bruzenak lenny at magitekltd.com
Wed Jan 28 17:44:27 UTC 2009


On Wed, 2009-01-28 at 12:15 -0500, Steve Grubb wrote:
> ...
> 
> Offhand, I don't remember why the kernel sets the limit so low. It could be 
> bumped some. How much, I don't know. 4K or 8K would seem fine.
> 
> -Steve

Thanks Steve!

To me the primary thing is consistency with the input text size.
Seems strange to successfully send in some data and be unable to
retrieve it.

A secondary concern is - what is the input limit? If the total input
buffer size is 8K and some of that needs to be used internally (by audit
lib), maybe it should be clamped at 7K? 
I'm trying to avoid a lot of retry logic on the sending side, where if a
failure occurs, we would truncate and resend until it passes. I guess if
I were certain that 7K is always going to fit I could artificially clamp
my own input there, but it seems better if it were universally constant.

Thx,
LCB.

-- 
LC (Lenny) Bruzenak
lenny at magitekltd.com




More information about the Linux-audit mailing list