On Thu, Jun 18, 2020 at 9:39 AM Steve Grubb <[email protected]> wrote: > The kernel cannot grow the backlog unbounded. If you do nothing, the backlog > is 64 - which is too small to really use. Otherwise, you set the backlog to a > finite number with the -b option.
If one were to set the backlog limit to 0, it is effectively disabled allowing the backlog to grow without any restrictions placed on it by the audit subsystem. -- paul moore www.paul-moore.com -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
