Audit record emission

[Steve Grubb]

Hi,

I was looking into a problem from the test team and ran across this comment in 
the kernel code:

http://lxr.linux.no/source/kernel/auditsc.c#L652

It basically says that audit records may be emitted as event records are 
generated as opposed to syscall exit. The problem shows up during stress 
testing. The records that get sent from the kernel are no where close to each 
other and are hard to correlate.

The comment says that if the current technique isn't suitable, maybe we can 
keep formatted records off of the context and then send them all at syscall 
exit. 

Can anyone see any problems with changing this?

-Steve