Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We're using the Linux audit subsystem to monitor process execution.

# in audit.rules
-a exit,always -F arch=b32 -F subj_user=unconfined_u -S execve
-a exit,always -F arch=b64 -F subj_user=unconfined_u -S execve

On our compute nodes, sometimes the workload exceeds the buffer size, causing us to see messages like this:

Oct  9 14:18:44 node3-1 kernel: __ratelimit: 22160 callbacks suppressed
Oct  9 14:18:44 node3-1 kernel: audit: audit_backlog=321 > audit_backlog_limit=320
Oct  9 14:18:44 node3-1 kernel: audit: audit_lost=696213835 audit_rate_limit=0 audit_backlog_limit=320

No amount of increasing audit_backlog has accommodated this workload, and these logs just tend to drown out other messages, so I want to silence this warning on select nodes.

# in audit.rules
-f 0

According to the auditctl manpage, 0=silent, 1=printk (and 2=panic). I can confirm that the failure flag is set correctly...

$ sudo auditctl -s
AUDIT_STATUS: enabled=1 flag=0 pid=36957 rate_limit=0 backlog_limit=320 lost=696721403 backlog=320

...but I still get the same logs in syslog.

A different manpage indicates that, perhaps, 0=printk, and 1=silent; so I explicitly tried setting it to 1, as well...

$ sudo auditctl -f 1
AUDIT_STATUS: enabled=1 flag=1 pid=36957 rate_limit=0 backlog_limit=320 lost=697095780 backlog=321

...but, still, I get logs.

Oct  9 14:25:55 node3-1 kernel: __ratelimit: 33371 callbacks suppressed
Oct  9 14:25:55 node3-1 kernel: audit: audit_backlog=321 > audit_backlog_limit=320
Oct  9 14:25:55 node3-1 kernel: audit: audit_lost=697172009 audit_rate_limit=0 audit_backlog_limit=320
Oct  9 14:25:55 node3-1 kernel: audit: backlog limit exceeded

How can I disable these messages?


$ cat /proc/version
Linux version 2.6.32-358.6.2.el6.x86_64 (mockbuild@c6b8.bsys.dev.centos.org) (gcc version 4.4.7 20120313 (Red Hat 4.4.7-3) (GCC) ) #1 SMP Thu May 16 20:59:36 UTC 2013
$ cat /etc/centos-release 
CentOS release 6.2 (Final)
$ rpm -qa | grep audit
audit-libs-python-2.1.3-3.el6.x86_64
audit-libs-2.1.3-3.el6.x86_64
audit-2.1.3-3.el6.x86_64
share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.