Lost events during boot

[Steve Grubb]

Hello Richard and Paul,

I was going to do a blog write up about booting the system with 
audit_backlog_limit=8192 for STIG users and have stumbled on to a mystery. The 
kernel initializes the variable to 64 at power on. During boot, if audit == 1, 
then it holds events in the hopes that an audit daemon will show up later and 
drain all the events. Anything over 64 events should fall off the end and 
increment the lost counter and put a notice in syslog.

However, when booting with audit_backlog_limit=8192, as soon as I log in I run 
"auditctl -s" I can see I've lost 73 events. The I run "aureport --start boot" 
and I see 644 total events. This is nowhere near the 8192 limit that I asked 
for. So, why am I losing events?

Additionally, I checked the logs and there is absolutely no message in syslog 
showing that I've lost events. This is with failure mode set to 1 - which is 
default at power on. And this is in spite of the the fact that the source code 
seems to show that it should have printk'ed something.

Any ideas? Can you replicate this finding?

-Steve