A number of diagnostic patches including a /proc/audit* interface to get a better view of what is happenning with what frequency in the audit queue code.
Richard Guy Briggs (13): audit_debug: set reserve to same size as backlog audit_debug: squawk when digging into reserve audit_debug: proc instrumentation audit_debug: add /proc counters for overflows, waiters, recovers, reserves audit_debug: proc debug output easier to paste audit_debug: don't let systemd change config audit_debug: instrument audit_cmd_mutex contention audit_debug: seperate out audit_titles in proc display netlink_debug: instrument timing of calls by init/systemd or audit_pid audit_debug: bark on impossible reserve process conditions in while loop audit_debug: instrument audit_receive timing audit_debug: list processes and frequencies waiting for auditd audit_debug: print inode nr for each path when listing exe rules include/linux/skbuff.h | 16 ++++ kernel/audit.c | 219 ++++++++++++++++++++++++++++++++++++++++++++-- kernel/audit.h | 2 + kernel/audit_fsnotify.c | 5 + kernel/auditfilter.c | 1 + net/netlink/af_netlink.c | 16 ++++ 6 files changed, 250 insertions(+), 9 deletions(-) -- Linux-audit mailing list Linux-audit@redhat.com https://www.redhat.com/mailman/listinfo/linux-audit