On Thursday 05 May 2005 17:34, Chris Wright wrote: > I always get drops with the following simple setup (default auditd.conf): <snip> > It's pathological, but always overloads the system which is useful for > testing. FWIW, I ran this for hours and had no lost messages. I tested with a backlog of 1024 & priority_boost of 3. -Steve