On Thu, Jun 18, 2020 at 9:39 AM Steve Grubb <sgr...@redhat.com> wrote: > The kernel cannot grow the backlog unbounded. If you do nothing, the backlog > is 64 - which is too small to really use. Otherwise, you set the backlog to a > finite number with the -b option.
If one were to set the backlog limit to 0, it is effectively disabled allowing the backlog to grow without any restrictions placed on it by the audit subsystem. -- paul moore www.paul-moore.com -- Linux-audit mailing list Linux-audit@redhat.com https://www.redhat.com/mailman/listinfo/linux-audit
