overhead of auditd

[杨海]

Hi,


Turning on all system calls in audit.rules, and transferring a tar file to the target system (CentOS 7, 4 cores), I found "auditd" consumes high CPU usage.
Is it expected? 
BTW, after turning write-logs off, and add dispatcher, both "audispd" and "auditd" are consuming high CPU.




Regards
Hai
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20190712/f96aebcf/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: DAF3F9AF at 3D976D26.41FD275D.png
Type: application/octet-stream
Size: 22967 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20190712/f96aebcf/attachment.obj>