audit.log space requirements:

Steve Grubb sgrubb at redhat.com
Wed Jun 15 21:14:22 UTC 2005


Thanks for the info. This is helpful

On Wednesday 15 June 2005 17:08, you wrote:
> On a largish server that's pretty busy the
> rate is about 20MB/minute on Irix. That't
> with no audit on network packet delivery, and
> audit turned on for file opens and attribute
> modifications. 

I wonder how many events that translates into. Just so we get a feel for 
average bytes per event.

> Irix is more aggressive about putting file and
> process attributes in records than y'all are,
> so I expect your records are a wee bit smaller.

One difference is that we are purely text mode right now. No binary records. 
What we are trying to determine is if this is going to cause us problems.

-Steve




More information about the Linux-audit mailing list