Handling disk full & No Kernel resources

[Peter Martuccelli]

Hello,

On Wed, 2005-01-05 at 13:11, Steve Grubb wrote:
> On Wednesday 05 January 2005 11:40, Casey Schaufler wrote:
> >  the only behavior that has ever been considered reliable is
> > for the audit deamon to send the system into
> > single user (or turn it off) when audit space is
> > not available. 
> 
> So then how do you bring it back up? If it shuts down when there's no room and 
> you restart the system, there's still no room. Is it expected for users to 
> disable auditing at boot, or boot to single user mode and then clear disk 
> space? Just curious what the customer support for this is like.
You can disable the syscall audit and SELinux support on the kernel
command line.  Would documenting the kernel command line options of
"audit=0 selinux=0" suffice for CAPP?  This way a user has a documented
process for recovering from a disk full condition.


Peter -