|
|
UTM5 5.2.1-006 (Default branch)
10-08-2008
|
|
diskaudit_flush_interval(5) File Formats Manual diskaudit_flush_interval(5) NAME
diskaudit_flush_interval - determine time interval (in secs) for flushing audit records VALUES
Failsafe Default Allowed values Recommended values DESCRIPTION
The tunable controls the periodic interval between two consecutive flushes of audit records buffered in the kernel memory which is bound to a kernel thread. This kernel thread has 64KB of buffer size to hold the audit records, and there can be a maximum of 32 such threads. These kernel threads automatically flush their buffers if the buffers fill up completely, but that might take a long time depending upon the activities in the system. The value of the tunable should be set such that the threads keep cleaning their buffers when they are approximately half full, or are idle for a long time but still holding some data in the buffer. Keeping the tunable value too low will make threads flush too soon and may lead to too many small write operations, thus impacting performance. On the other hand, keeping the value too high might lead to high unflushed memory consumption. Who Is Expected to Change This Tunable? An administrator with proper privileges can change the value of Restrictions on Changing None. This tunable is dynamic. When Should the Value of This Tunable Be Raised? When the system is not processing many audit-related activities. What are the Side Effects of Raising the Value? If the system is generating large numbers of records, and the value is raised, then it can result in a lot of unflushed memory, and might slow down the system. When Should the Value of This Tunable Be Lowered? When the system is generating a lot of audit records. What are the Side Effects of Lowering the Value? If the system is not generating too many records, and the value is lowered, it might lead to a lot of small numbers of writes, which actu- ally only write to buffer cache and not immediately to the physical disk, with the actual write happening later on. This might impact per- formance again. What Other Tunable Values Should Be Changed at the Same Time? None. WARNINGS
All HP-UX kernel tunable parameters are release specific. This parameter may be removed or have its meaning changed in future releases of HP-UX. Installation of optional kernel software, from HP or other vendors, may cause changes to tunable parameter values. After installation, some tunable parameters may no longer be at the default or recommended values. For information about the effects of installation on tun- able values, consult the documentation for the kernel software being installed. For information about optional kernel software that was factory installed on your system, see at AUTHOR
was developed by HP. SEE ALSO
audit(5). Tunable Kernel Parameters diskaudit_flush_interval(5)