And to answer your question, about what could cause such a burst of
events, this time I have an easy answer: mdevd-coldplug !
Yes, I forgot to mention this.
The kernel-generated events seem to be significantly heavier than the
mdev-style synthetic ones. The DEVPATH is the full path without
symlinks, which is usually pretty long, and there are also a bunch
of misc variables with every event. It's very common for a kernel-
generated event to reach 250 bytes, which means a 64kB buffer can
only hold 256 events, and probably less because some events are
easily 300 bytes long; so I tripled the buffer size.
If it's not enough for a run-of-the-mill desktop PC, I should
increase it again. 1 MB sounds really excessive though: it means
it would be able to hold 3000 to 4000 events. Can you run
mdevd-coldplug with a dry-run mdevd to count the number of events,
you're getting and their approximate size? A nice trick to trace
events is to add the following line at the top of your mdev.conf file:
-.* 0:0 0600 ! @env
which will send a bunch of lines to your catch-all logger. :)
Thanks for testing!