• R
    audit: add kernel set-up parameter to override default backlog limit · f910fde7
    Richard Guy Briggs 提交于
    The default audit_backlog_limit is 64.  This was a reasonable limit at one time.
    
    systemd causes so much audit queue activity on startup that auditd doesn't
    start before the backlog queue has already overflowed by more than a factor of
    2.  On a system with audit= not set on the kernel command line, this isn't an
    issue since that history isn't kept for auditd when it is available.  On a
    system with audit=1 set on the kernel command line, kaudit tries to keep that
    history until auditd is able to drain the queue.
    
    This default can be changed by the "-b" option in audit.rules once the system
    has booted, but won't help with lost messages on boot.
    
    One way to solve this would be to increase the default backlog queue size to
    avoid losing any messages before auditd is able to consume them.  This would
    be overkill to the embedded community and insufficient for some servers.
    
    Another way to solve it might be to add a kconfig option to set the default
    based on the system type.  An embedded system would get the current (or
    smaller) default, while Workstations might get more than now and servers might
    get more.
    
    None of these solutions helps if a system's compiled default is too small to
    see the lost messages without compiling a new kernel.
    
    This patch adds a kernel set-up parameter (audit already has one to
    enable/disable it) "audit_backlog_limit=<n>" that overrides the default to
    allow the system administrator to set the backlog limit.
    Signed-off-by: NRichard Guy Briggs <rgb@redhat.com>
    Signed-off-by: NEric Paris <eparis@redhat.com>
    f910fde7
kernel-parameters.txt 121.4 KB