audit_log_drain

[Steve Grubb]

On Wednesday 06 April 2005 12:00, Steve Grubb wrote:
> The fact is that as long as we have space in the backlog, we don't have to
> lose a packet do we?

Specifically, I'm talking about this:

522                 if (retval == -EAGAIN && ab->count < 5) {
523                         ++ab->count;
524                         skb_queue_tail(&ab->sklist, skb);
525                         audit_log_end_irq(ab);
526                         return 1;
527                 }

ab->count < 5 sounds arbitrary. I'd rather see it:

	if (retval == -EAGAIN && audit_backlog < (audit_backlog_limit-1))

Does this make more sense? The idea is to try to leave room for 1 more packet 
that could trigger the audit_log_drain.

-Steve