Auditd cause high CPU and high Load

[Steve Grubb]

Hello,

On Thursday, December 1, 2016 11:59:47 AM EST Minh Tien Nguyen wrote:
> My name is Nguyen Minh Tien. I came from Singapore. I am working as a
> developer for Garena LTD. Last week, I met a problem with Audit on our
> product servers. The Auditd process had caused of some pick time on our
> server. In that times, system CPU cost a lot, around 100%. And the Load
> average is over 30. We have tried to find the root cause and have failed.
> Could you help us for that case?
> 
> The servers, which meet the performance issue, use Redhat 6.8 and their
> kernel is 2.6.32.

You might want to check the flush setting for /etc/audit/auditd.conf. I would 
recommend using incremental and set the freq to something like 200 or 500. 
Using sync or data will kill performance, but the event is written to disk 
before processing the next event.

-Steve