I would like to use OSQuery instead of the Linux audit daemon. In my testing on Ubuntu 18.04, if OSQuery binds to the kernel security module and the auditd package is installed, it complains about audit messages being malformed. Removing the auditd package solves this problem.
I would also like to use AppArmor, which also generates a significant number of events for the kernel auditing system.
I constantly see messages like: audit: audit_lost=21473 audit_rate_limit=0 audit_backlog_limit=4096
When I had the audit package installed, I could use "auditctl -b XXX" to increase the audit backlog limit. But that tool was removed with the auditd package.
I've tried putting the "-b 8096" flag in the /etc/audit/rules.d/audit.rules file, but the backlog limit always stays fixed at 4096.
Is there some other setting in something like sysctl.conf that can be used to control the size of the audit backlog?
Thanks in advance.