BIG performance hit with auditd on large systems (>64 CPUs)

[Paul Moore]

On Fri, May 19, 2017 at 2:52 PM, Klaus Lichtenwalder
<klic at mnet-online.de> wrote:
> Hi,
>
> we have a few SAP systems on RHEV (so virtualized on KVM) with >= 74
> CPUs and >= 400G RAM.
> When the system is busy with large SAP jobs, it goes onto its knees with
> cpu %system up to 80%, thus making the SAP jobs run twice as long. As
> soon as you stop auditd everything returns to normal...
>
> Facts:
> RHEL6 instances on RHEL7 hosts.
> the rule set (see below) runs fine on any other system with less cpus
> (<64, maybe this is the cut off?). We have smaller systems with this
> rule set that rotate the audit file nearly every minute without any
> noticable performance hit, these SAP systems rotate once every
> 20-24hours....

While we might occasionally provide distribution specific advice and
troubleshooting on the upstream lists, you are best off bringing
things like this up via support contract with your distro vendor.

-- 
paul moore
www.paul-moore.com