audit.log space requirements:
Steve Grubb
sgrubb at redhat.com
Wed Jun 15 21:14:22 UTC 2005
Thanks for the info. This is helpful
On Wednesday 15 June 2005 17:08, you wrote:
> On a largish server that's pretty busy the
> rate is about 20MB/minute on Irix. That't
> with no audit on network packet delivery, and
> audit turned on for file opens and attribute
> modifications.
I wonder how many events that translates into. Just so we get a feel for
average bytes per event.
> Irix is more aggressive about putting file and
> process attributes in records than y'all are,
> so I expect your records are a wee bit smaller.
One difference is that we are purely text mode right now. No binary records.
What we are trying to determine is if this is going to cause us problems.
-Steve
More information about the Linux-audit
mailing list