<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <style></style> </head> <body lang="EN-US" link="blue" vlink="purple"> <div class="WordSection1"> Thanks for the quick reply Satish. <o:p></o:p> <o:p> </o:p> From: Satish Chandra Kilaru [<a href="mailto:iam.kilaru@gmail.com">mailto:iam.kilaru@gmail.com</a>] Sent: Wednesday, January 28, 2015 8:49 PM To: Viswanath, Logeswari P (MCOU OSTL) Cc: <a href="mailto:linux-audit@redhat.com">linux-audit@redhat.com</a> Subject: Re: Linux audit performance impact<o:p></o:p> <o:p> </o:p> Write your own program to receive audit events directly without using auditd... <o:p></o:p> <div> That should be faster ....<o:p></o:p> </div> <div> Auditd will log the events to disk causing more I/o than u need... On Wednesday, January 28, 2015, Viswanath, Logeswari P (MCOU OSTL) <<a href="mailto:logeswari.pv@hp.com">logeswari.pv@hp.com</a>> wrote:<o:p></o:p> <blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt"> <div> <div> Hi Steve,<o:p></o:p> <o:p></o:p> I am Logeswari working for HP. <o:p></o:p> <o:p></o:p> We want to know audit performance impact on RHEL and Suse linux to help us evaluate linux audit as data source for our host based IDS.<o:p></o:p> When we ran our own performance test with a test audispd plugin, we found if a system can perform 200000 open/close system calls per second without auditing, system can perform only 3000 open/close system calls auditing is enabled for open/close system call which is a HUGE impact on the system performance. It would be great if anyone can help us answering the following questions.<o:p></o:p> <o:p></o:p> 1) Is this performance impact expected? If yes, what is the reason behind it and can we fix it?<o:p></o:p> 2) Have anyone done any benchmarking for performance impact? If yes, can you please share the numbers and also the steps/programs used the run the same.<o:p></o:p> 3) Help us validating the performance test we have done in our test setup using the steps mentioned along with the results attached.<o:p></o:p> <o:p></o:p> Attached test program (loader.c) to invoke open and close system calls.<o:p></o:p> Attached idskerndsp is the audispd plugin program.<o:p></o:p> We used time command to determine how much time the system took to complete 50000 open/close system calls without (results attached Without-auditing) and with auditing enabled on the system (With-auditing-NOLOG-audispd-plugin and With-auditing-RAW)<o:p></o:p> <o:p></o:p> System details:<o:p></o:p> <o:p></o:p> 1 CPU machine<o:p></o:p> <o:p></o:p> OS Version<o:p></o:p> RHEL 6.5<o:p></o:p> <o:p></o:p> Kernel Version<o:p></o:p> uname –r<o:p></o:p> 2.6.32-431.el6.x86_64<o:p></o:p> <o:p></o:p> Note: auditd was occupying 35% of CPU and was sleeping for most of the time whereas kauditd was occupying 20% of the CPU.<o:p></o:p> <o:p></o:p> Thanks & Regards,<o:p></o:p> Logeswari.<o:p></o:p> <o:p></o:p> <o:p></o:p> </div> </div> </blockquote> </div> -- Please Donate to <a href="http://www.wikipedia.org">www.wikipedia.org</a><o:p></o:p> </div> </body> </html>