On Wed, Jan 20, 2021 at 1:38 AM Burn Alting <[email protected]> wrote: > All, > > How is the following for a way forward. > > a. I will author a patch to the user space code to correctly parse this > condition and submit it on the weekend. It will be via a new configuration > item to auditd.conf just in case placing a fixed extended timeout (15-20 > secs) affects memory usage for users of the auparse library. This solves the > initial problem of ausearch/auparse failing to parse generated audit. > b. I am happy to instrument what ever is recommended on my hosts at home > (vm's and bare metal) to provide more information, should we want to > 'explain' the occurrence, given I see this every week or two and report back.
Seems reasonable to me. -- paul moore www.paul-moore.com -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
