On Thursday 05 May 2005 17:26, Linda Knippers wrote: > I'm using the 0.7.3-1 user-space tools and the .28 kernel. I'm using > the default auditd.conf file, which has priority_boost = 3. OK. I put -b 1024 in the /etc/audit.rules file. 64 backlog slots is the norm - this doesn't give you any headroom for stressful times. -Steve