[PATCH v2] audit: report audit wait metric in audit status reply

Steve Grubb sgrubb at redhat.com
Mon Dec 7 23:28:22 UTC 2020


Hello Max,

On Monday, December 7, 2020 4:28:14 PM EST Max Englander wrote:
> Steve, I'm happy to make changes to the userspace PR based on
> Richard's suggestions, if that sounds good to you. I'll follow up in
> the PR to discuss it more

The only issue is new userspace on old kernel. I think if we use both the 
configure macro in addition to a size check, then it will at least allow 
forward and backward compatibility.

Other metrics would be good. I'd like to see a max_backlog to know if we are 
wasting memory. It would just record the highwater mark since auditing was 
enabled.

-Steve





More information about the Linux-audit mailing list