On Monday 31 July 2006 16:05, Clif Flynt wrote: > > The database file is only locked for the duration > > of the write operation - not while the database is open. A write > > normally takes a few milliseconds, then the lock goes away.
The issue here is that you may need write to have priority since there is potentially a backlog building in the kernel. If the backlog gets too big you will get a panic. The write operation has to be fast. But suppose there are readers. Does the write block or fail? More of a curiosity to me. > > Why is 256 bytes of data for each 1MiB of database a problem? > > Is memory so short and databases so large that this might cause > > a problem? Database could be huge. A paranoid admin could easily get gigabytes of data in a short time. Or maybe someone that wrote a rule that captures too much data could run into a problem. > > If it is, then increase the page size from the default 1K. > > The actually usage is 2 bits per page of data. So if pages > > are 32KiB bytes instead of 1KiB, a 1MiB database only needs > > 8 bytes of storage for the bitmap. This is good to know. That would probably help. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
