On Wed, 2009-01-28 at 12:15 -0500, Steve Grubb wrote: > ... > > Offhand, I don't remember why the kernel sets the limit so low. It could be > bumped some. How much, I don't know. 4K or 8K would seem fine. > > -Steve
Thanks Steve! To me the primary thing is consistency with the input text size. Seems strange to successfully send in some data and be unable to retrieve it. A secondary concern is - what is the input limit? If the total input buffer size is 8K and some of that needs to be used internally (by audit lib), maybe it should be clamped at 7K? I'm trying to avoid a lot of retry logic on the sending side, where if a failure occurs, we would truncate and resend until it passes. I guess if I were certain that 7K is always going to fit I could artificially clamp my own input there, but it seems better if it were universally constant. Thx, LCB. -- LC (Lenny) Bruzenak [email protected] -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
