sysctl auditing

Rezney · 10-02-2015, 05:14 AM

Hello,

After disabling vm.nr_hugepages in sysctl and rebooting some app or script is setting the hugepages again. Is there any way to find out what is doing that? I was thinking about some audit rules on sysctl.conf.

Do you have any idea how to set the rule?

Thanks...

Rezney · 10-02-2015, 07:00 AM

I just came up with this:

auditctl -w /sbin/sysctl -p x -k sysctl-exec
auditctl -w /proc/sys/vm/nr_hugepages -p rwxa -k hugepages-change

Hope it will work...