mode = forward

[Michael Mather]

I am using Ubuntu 12.04, which uses version 1.7.18 of auditd.

Audispd is complaining that the queue is full and it is dropping events.

According to the man page for audisp-remote.conf (as found at
linux.die.net), the parameter "mode" can be set to "immediate" or
"forward". "forward" means that events are buffered in a queue.

I found that "mode" was set to "immediate", and the queue did not exist.

But when I try to set the value as "forward" and restart auditd,
audisp-remote complains that "Option forward not found". And the queue
still gets full.

Last October, Steve was writing about how big the queue might be on this
very site.

Can someone explain what is going on?

Thanks - Michael
----------------