Novell LINUX ENTERPRISE DESKTOP 11, Manual, Page: 401 / 450

Command Meaning [Possible Values] Flag
auditctl -r
rate
Set a limit in messages per second. If the
rate is not zero and it is exceeded, the ac-
tion specified in the failure flag is trig-
gered. rate_limit
auditctl -b
backlog
Specify the maximum number of outstand-
ing audit buffers allowed. If all buffers
are full, the action specified in the failure
flag is triggered. backlog_limit
— Count the current number of lost audit
messages. lost
— Count the current number of outstanding
audit buffers. backlog
30.4 Passing Parameters to the Audit
System
Commands to control the audit system can be invoked individually from the shell using
auditctl or batch read from a file using
auditctl -R
. This second method is used
by the init scripts to load rules from the file
/etc/audit/audit.rules
after the
audit daemon has been started. The rules are executed in order from top to bottom. Each
of these rules would expand to a separate auditctl command. The syntax used in the
rules file is the same as that used for the auditctl command.
Changes made to the running audit system by executing auditctl on the command line
are not persistent across system restarts. For changes to persist, add them to the
/etc/
audit/audit.rules
file and, if they are not currently loaded into audit, restart the
audit system to load the modified rule set by using the
rcauditd restart
command.
Understanding Linux Audit 387