Possible performance bug

Steve Grubb sgrubb at redhat.com
Sat Sep 10 14:11:04 UTC 2005


On Friday 09 September 2005 19:00, Linda Knippers wrote:
> Has anyone checked to make sure that auditd is
> really started early enough that the current behavior is ok?  Maybe
> it is for CAPP but is it for a random admin who wants auditing?

In my init scripts, its boot priority is 18. This is the boot order:

#cd /etc/rc.d/init.d/
#grep 'chkconfig:' * | sort -n -k 4
diskdump:# chkconfig: - 04 94
readahead_early:# chkconfig: 5 4 99
kudzu:# chkconfig: 345 05 95
iptables:# chkconfig: 2345 08 92
network:# chkconfig: 2345 10 90
named:# chkconfig: - 11 89
netplugd:# chkconfig: - 11 89
syslog:# chkconfig: 2345 12 98
portmap:# chkconfig: 345 13 87
mdmonitor:# chkconfig: 2345 15 85
mdmpd:# chkconfig: - 15 85
auditd:# chkconfig: 2345 18 87

I think pcmcia is 17 and that's why auditd is at 18. I might be able to scoot 
up to 13, but I think that's about it. That would also mean that you couldn't 
use nfs as a storage location since portmap hasn't run. For CAPP, you 
wouldn't want to use nfs, but for the casual user, it could be a valid way to 
run. The above table is from my home machine & not an everything installed 
machine.

-Steve




More information about the Linux-audit mailing list