![centos7 audit.rules 的最佳值是多少](https://linux22.com/image/1538604/centos7%20audit.rules%20%E7%9A%84%E6%9C%80%E4%BD%B3%E5%80%BC%E6%98%AF%E5%A4%9A%E5%B0%91.png)
我现在患有audit : backlog limit exceeded
。
我发现了一些具有类似情况的文章,他们说用它来调整审计日志计数audit.rules
。
这是我的audit.rules
## This file is automatically generated from /etc/audit/rules.d
-D
-b 320
我想将其改得320
稍微高一些,但我不知道如何设置适当的值。(我甚至不知道这个值与内存或打开文件有关)
通过观察audit.log
,我假设它记录了几乎所有与守护进程一起工作的命令。我在机器中安装了 4 个 docker 容器和 1 个 qemu VM。
非常感谢您提供建议或参考。我想为此设置最佳值audit
,以防止机器被禁用。谢谢!
仅供参考,这是我的memInfo
MemTotal: 65755736 kB
MemFree: 62985572 kB
MemAvailable: 63955852 kB
Buffers: 5136 kB
Cached: 1169252 kB
SwapCached: 0 kB
Active: 1198532 kB
Inactive: 750240 kB
Active(anon): 775204 kB
Inactive(anon): 8352 kB
Active(file): 423328 kB
Inactive(file): 741888 kB
Unevictable: 0 kB
Mlocked: 0 kB
SwapTotal: 29200380 kB
SwapFree: 29200380 kB
Dirty: 6708 kB
Writeback: 964 kB
AnonPages: 799520 kB
Mapped: 38752 kB
Shmem: 9140 kB
Slab: 170132 kB
SReclaimable: 60620 kB
SUnreclaim: 109512 kB
KernelStack: 8448 kB
PageTables: 39464 kB
NFS_Unstable: 0 kB
Bounce: 0 kB
WritebackTmp: 0 kB
CommitLimit: 62078248 kB
Committed_AS: 17605768 kB
VmallocTotal: 34359738367 kB
VmallocUsed: 497488 kB
VmallocChunk: 34325640552 kB
HardwareCorrupted: 0 kB
AnonHugePages: 686080 kB
HugePages_Total: 0
HugePages_Free: 0
HugePages_Rsvd: 0
HugePages_Surp: 0
Hugepagesize: 2048 kB
DirectMap4k: 139264 kB
DirectMap2M: 4026368 kB
DirectMap1G: 65011712 kB