Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We're using the Linux audit subsystem to monitor process execution.

# in audit.rules
-a exit,always -F arch=b32 -F subj_user=unconfined_u -S execve
-a exit,always -F arch=b64 -F subj_user=unconfined_u -S execve

On our compute nodes, sometimes the workload exceeds the buffer size, causing us to see messages like this:

Oct  9 14:18:44 node3-1 kernel: __ratelimit: 22160 callbacks suppressed
Oct  9 14:18:44 node3-1 kernel: audit: audit_backlog=321 > audit_backlog_limit=320
Oct  9 14:18:44 node3-1 kernel: audit: audit_lost=696213835 audit_rate_limit=0 audit_backlog_limit=320

No amount of increasing audit_backlog has accommodated this workload, and these logs just tend to drown out other messages, so I want to silence this warning on select nodes.

# in audit.rules
-f 0

According to the auditctl manpage, 0=silent, 1=printk (and 2=panic). I can confirm that the failure flag is set correctly...

$ sudo auditctl -s
AUDIT_STATUS: enabled=1 flag=0 pid=36957 rate_limit=0 backlog_limit=320 lost=696721403 backlog=320

...but I still get the same logs in syslog.

A different manpage indicates that, perhaps, 0=printk, and 1=silent; so I explicitly tried setting it to 1, as well...

$ sudo auditctl -f 1
AUDIT_STATUS: enabled=1 flag=1 pid=36957 rate_limit=0 backlog_limit=320 lost=697095780 backlog=321

...but, still, I get logs.

Oct  9 14:25:55 node3-1 kernel: __ratelimit: 33371 callbacks suppressed
Oct  9 14:25:55 node3-1 kernel: audit: audit_backlog=321 > audit_backlog_limit=320
Oct  9 14:25:55 node3-1 kernel: audit: audit_lost=697172009 audit_rate_limit=0 audit_backlog_limit=320
Oct  9 14:25:55 node3-1 kernel: audit: backlog limit exceeded

How can I disable these messages?


$ cat /proc/version
Linux version 2.6.32-358.6.2.el6.x86_64 (mockbuild@c6b8.bsys.dev.centos.org) (gcc version 4.4.7 20120313 (Red Hat 4.4.7-3) (GCC) ) #1 SMP Thu May 16 20:59:36 UTC 2013
$ cat /etc/centos-release 
CentOS release 6.2 (Final)
$ rpm -qa | grep audit
audit-libs-python-2.1.3-3.el6.x86_64
audit-libs-2.1.3-3.el6.x86_64
audit-2.1.3-3.el6.x86_64
share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.