configuration for busy docker host

[Frederik Bosch]

Hello Audit team,

As I have not found a location anywhere else on the web, I am sending my 
question to this list. I have an Ubuntu 18.04 machine with auditd and it 
acts as a Docker Host machine. I have hardened the system via this 
package: https://github.com/konstruktoid/hardening which installs auditd 
with the configuration to be found here: 
https://github.com/konstruktoid/hardening/blob/master/misc/audit.rules.

The problems I have are related to the directives -f and -b. The 
hardening package uses -b 8192 and -f 2. That results in a kernel panic 
very quickly because of audit backlog limit exceeded, and that causes a 
reboot of the system. Now I wonder what a good configuration would be. I 
started reading on the subject and read that -f 2 is probably the best 
for security reasons. However, I do not want to have a system that 
panics very quickly and reboots.

Should I simply increase the backlog to much higher numbers? Or should I 
change -f to not cause a kernel panic? Or am I missing something and 
should I change some other configuration? Thanks for your help.

Kind regards,
Frederik Bosch