<div>Hi Steve,</div><div><br></div><div>I ever read the document you wrote about laying IDS on top of auditd. And I suppose inotify could be lightweight for IDS. Any comment?</div><div><sign signid="98"><br></sign></div><div><sign signid="98">Best regards</sign></div><div><sign signid="98">Hai</sign><sign signid="98"><br></sign></div><div><sign signid="98"><div style="font-size:14px;font-family:Verdana;color:#000;"><div style="overflow:hidden;"><table class="preview_table"><tbody><tr><td valign="middle"><br></td><td valign="middle" style="color:#a0a0a0;font-size:12px;"></td></tr></tbody></table></div></div></sign></div><div><includetail><div></div><div> </div><div style="font:Verdana normal 14px;color:#000;"><div style="FONT-SIZE: 12px;FONT-FAMILY: Arial Narrow;padding:2px 0 2px 0;">------------------ Original ------------------</div><div style="FONT-SIZE: 12px;background:#efefef;padding:8px;"><div id="menu_sender"><b>From: </b> "Steve Grubb"<sgrubb@redhat.com>;</div><div><b>Date: </b> Fri, Jul 12, 2019 08:14 PM</div><div><b>To: </b> "linux-audit"<linux-audit@redhat.com>; <wbr></div><div><b>Cc: </b> "杨海"<hai.yang@magic-shield.com>; <wbr></div><div><b>Subject: </b> Re: overhead of auditd</div></div><div> </div><div style="position:relative;"><div id="tmpcontent_res"></div>Hello,<br><br>On Thursday, July 11, 2019 11:23:45 PM EDT 杨海 wrote:<br>> Turning on all system calls in audit.rules, and transferring a tar file to<br>> the target system (CentOS 7, 4 cores), I found "auditd" consumes high CPU<br>> usage. Is it expected?<br><br>It would not be surprising. Some system calls have more overhead than others. <br>So, depending on everything that is running, you can kill your system.<br><br>> BTW, after turning write-logs off, and add dispatcher, both "audispd" and<br>> "auditd" are consuming high CPU.<br><br>They have a lot of events to handle.<br><br>-Steve<br><br></div></div></includetail></div>