Hello Max, On Monday, December 7, 2020 4:28:14 PM EST Max Englander wrote: > Steve, I'm happy to make changes to the userspace PR based on > Richard's suggestions, if that sounds good to you. I'll follow up in > the PR to discuss it more
The only issue is new userspace on old kernel. I think if we use both the configure macro in addition to a size check, then it will at least allow forward and backward compatibility. Other metrics would be good. I'd like to see a max_backlog to know if we are wasting memory. It would just record the highwater mark since auditing was enabled. -Steve -- Linux-audit mailing list Linux-audit@redhat.com https://www.redhat.com/mailman/listinfo/linux-audit
