diskaudit_flush_interval(5)					File Formats Manual				       diskaudit_flush_interval(5)

NAME

       diskaudit_flush_interval - determine time interval (in secs) for flushing audit records

VALUES

   Failsafe
   Default
   Allowed values
   Recommended values
DESCRIPTION

       The tunable controls the periodic interval between two consecutive flushes of audit records buffered in the kernel memory which is bound to
       a kernel thread.  This kernel thread has 64KB of buffer size to hold the audit records, and there can be a  maximum  of	32  such  threads.
       These  kernel  threads  automatically flush their buffers if the buffers fill up completely, but that might take a long time depending upon
       the activities in the system.

       The value of the tunable should be set such that the threads keep cleaning their buffers when they are approximately half full, or are idle
       for a long time but still holding some data in the buffer.  Keeping the tunable value too low will make threads flush too soon and may lead
       to too many small write operations, thus impacting performance.	On the other hand, keeping the value too high might lead to high unflushed
       memory consumption.

   Who Is Expected to Change This Tunable?
       An administrator with proper privileges can change the value of

   Restrictions on Changing
       None.  This tunable is dynamic.

   When Should the Value of This Tunable Be Raised?
       When the system is not processing many audit-related activities.

   What are the Side Effects of Raising the Value?
       If  the	system is generating large numbers of records, and the value is raised, then it can result in a lot of unflushed memory, and might
       slow down the system.

   When Should the Value of This Tunable Be Lowered?
       When the system is generating a lot of audit records.

   What are the Side Effects of Lowering the Value?
       If the system is not generating too many records, and the value is lowered, it might lead to a lot of small numbers of writes, which  actu-
       ally only write to buffer cache and not immediately to the physical disk, with the actual write happening later on.  This might impact per-
       formance again.

   What Other Tunable Values Should Be Changed at the Same Time?
       None.

WARNINGS

       All HP-UX kernel tunable parameters are release specific.  This parameter may be removed or have its meaning changed in future releases	of
       HP-UX.

       Installation  of  optional  kernel  software, from HP or other vendors, may cause changes to tunable parameter values.  After installation,
       some tunable parameters may no longer be at the default or recommended values.  For information about the effects of installation  on  tun-
       able  values,  consult  the documentation for the kernel software being installed.  For information about optional kernel software that was
       factory installed on your system, see at

AUTHOR

       was developed by HP.

SEE ALSO

       audit(5).

							     Tunable Kernel Parameters				       diskaudit_flush_interval(5)