We ran into exactly the same issue with the update to 6.8. Using flush and
setting freq to 300 fixed the issue we were experiencing.
On Thu, Dec 1, 2016 at 9:00 AM Steve Grubb <sgr...@redhat.com> wrote:
> On Thursday, December 1, 2016 11:59:47 AM EST Minh Tien Nguyen wrote:
> > My name is Nguyen Minh Tien. I came from Singapore. I am working as a
> > developer for Garena LTD. Last week, I met a problem with Audit on our
> > product servers. The Auditd process had caused of some pick time on our
> > server. In that times, system CPU cost a lot, around 100%. And the Load
> > average is over 30. We have tried to find the root cause and have failed.
> > Could you help us for that case?
> > The servers, which meet the performance issue, use Redhat 6.8 and their
> > kernel is 2.6.32.
> You might want to check the flush setting for /etc/audit/auditd.conf. I
> recommend using incremental and set the freq to something like 200 or 500.
> Using sync or data will kill performance, but the event is written to disk
> before processing the next event.
> Linux-audit mailing list
Linux-audit mailing list