LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
  Search this Thread
Old 08-17-2009, 05:32 AM   #1
aclhkaclhk
Member
 
Registered: Mar 2009
Posts: 54

Rep: Reputation: 15
audit: backlog limit exceeded


using centos 5.1, /var/log/message shown

audit: audit_backlog=321 > audit_backlog_limit=320 audit: audit_lost=1704 audit_rate_limit=0 audit_backlog_limit=320 audit: backlog limit exceeded audit: audit_backlog=321 > audit_backlog_limit=320 audit: audit_lost=1705 audit_rate_limit=0 audit_backlog_limit=320 audit: backlog limit exceeded audit: audit_backlog=321 > audit_backlog_limit=320 audit: audit_lost=1706 audit_rate_limit=0 audit_backlog_limit=320 audit: backlog limit exceeded

#aureport --start today --event --summary -i
553 cred_acq
552 login
552 user_acct
551 user_start
509 cred_disp
509 user_END
2 user_login
2 user_auth
1 cred_refr

pls advise what is flooding the auditd?
 
Old 08-17-2009, 06:17 AM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594
Quote:
Originally Posted by aclhkaclhk View Post
pls advise what is flooding the auditd?
cred_.* / login / user_.* could point to cronjob probs but your output doesn't show. Might want to use rate limiting (say "-r 21000") and increase the buffer (say "-b $[320*2]" in /etc/audit/audit.rules (use 'auditctl').
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
File size limit exceeded... trist007 Linux - Newbie 3 02-27-2009 10:30 PM
File size limit exceeded sidra Red Hat 17 04-09-2007 01:51 PM
hard-limit quotas exceeded and how is that possible? openandout Linux - Enterprise 2 06-09-2006 05:21 AM
file size limit exceeded mchitrakar Linux - General 2 10-12-2004 12:47 PM
File size limit exceeded npuetz Linux - General 5 10-06-2004 07:34 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Software

All times are GMT -5. The time now is 01:35 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration