reaahead-collector abuses the audit logging facility to discover which files are accessed at boot time to make a pre-load list Add a tuning option to audit_backlog_wait_time so that if auditd can't keep up, or gets blocked, the callers won't be blocked. Bump audit_status API version to "2".
Showing the changes to include/uapi/linux (1 of 2 files). Show all
Unified · Split
| @@ -319,6 +319,7 @@ enum { · 318 unmodified lines | ||
| 319 | 319 | #define AUDIT_STATUS_PID 0x0004 |
| 320 | 320 | #define AUDIT_STATUS_RATE_LIMIT 0x0008 |
| 321 | 321 | #define AUDIT_STATUS_BACKLOG_LIMIT 0x0010 |
| 322 | +#define AUDIT_STATUS_BACKLOG_WAIT_TIME 0x0020 | |
| 322 | 323 | /* Failure-to-log actions */ |
| 323 | 324 | #define AUDIT_FAIL_SILENT 0 |
| 324 | 325 | #define AUDIT_FAIL_PRINTK 1 |
| @@ -377,6 +378,7 @@ struct audit_status { · 52 unmodified lines | ||
| 377 | 378 | __u32 lost; /* messages lost */ |
| 378 | 379 | __u32 backlog; /* messages waiting in queue */ |
| 379 | 380 | __u32 version; /* audit api version number */ |
| 381 | + __u32 backlog_wait_time;/* message queue wait timeout */ | |
| 380 | 382 | }; |
| 381 | 383 | |
| 382 | 384 | struct audit_features { |