![]() | ||||||||||
Messages in this thread |
> It is also never redundant functionality of audit subsystem, if enable > audit option, audit subsystem will audit all the syscalls, so it adds > big overhead for the whole system, this is not true > but Filesystem Event Connector just > concerns those operations related to the filesystem, so it has little > overhead, moreover, audit subsystem is a complicated function block, > it not only sends audit results to netlink interface, but also send > them to klog or syslog, so it will add big overhead. you can look File > Event Connector as subset of audit subsystem, but File Event Connector > is a very very lightweight subsystem. then make the syslog part optional.. if it's not already! - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/ | |||||||||
| Last update: 2006-03-24 07:01 [from the cache] ©2003-2008 | ||||||||||