[PATCH v2] audit: report audit wait metric in audit status reply
Steve Grubb
sgrubb at redhat.com
Mon Dec 7 23:28:22 UTC 2020
Hello Max,
On Monday, December 7, 2020 4:28:14 PM EST Max Englander wrote:
> Steve, I'm happy to make changes to the userspace PR based on
> Richard's suggestions, if that sounds good to you. I'll follow up in
> the PR to discuss it more
The only issue is new userspace on old kernel. I think if we use both the
configure macro in addition to a size check, then it will at least allow
forward and backward compatibility.
Other metrics would be good. I'd like to see a max_backlog to know if we are
wasting memory. It would just record the highwater mark since auditing was
enabled.
-Steve
More information about the Linux-audit
mailing list