Benchmarking the performance impact of auditd

[Steve Grubb]

On Thursday, August 29, 2013 12:59:33 PM zhu xiuming wrote:
> Has someone done some work related to the performance impact of enabling
> auditd on syscalls watching?

Yes, long ago.
http://people.redhat.com/sgrubb/files/lspp-perf.tar.gz

Short story is watches were undistinguishable from cache hit/misses and 
syscall auditing gets more impact as more rules get added and based on how 
complicated the rule is. CPU's have changed so much since I did the 
benchmarking that I won't even hazard a guess as to what the performance hit 
is on current hardware with current kernel.

-Steve