diskaudit_flush_interval(5)diskaudit_flush_interval(5)NAMEdiskaudit_flush_interval - determine time interval (in secs) for flush‐
ing audit records
VALUES
Failsafe
Default
Allowed values
Recommended values
DESCRIPTION
The tunable controls the periodic interval between two consecutive
flushes of audit records buffered in the kernel memory which is bound
to a kernel thread. This kernel thread has 64KB of buffer size to hold
the audit records, and there can be a maximum of 32 such threads.
These kernel threads automatically flush their buffers if the buffers
fill up completely, but that might take a long time depending upon the
activities in the system.
The value of the tunable should be set such that the threads keep
cleaning their buffers when they are approximately half full, or are
idle for a long time but still holding some data in the buffer. Keep‐
ing the tunable value too low will make threads flush too soon and may
lead to too many small write operations, thus impacting performance.
On the other hand, keeping the value too high might lead to high
unflushed memory consumption.
Who Is Expected to Change This Tunable?
An administrator with proper privileges can change the value of
Restrictions on Changing
None. This tunable is dynamic.
When Should the Value of This Tunable Be Raised?
When the system is not processing many audit-related activities.
What are the Side Effects of Raising the Value?
If the system is generating large numbers of records, and the value is
raised, then it can result in a lot of unflushed memory, and might slow
down the system.
When Should the Value of This Tunable Be Lowered?
When the system is generating a lot of audit records.
What are the Side Effects of Lowering the Value?
If the system is not generating too many records, and the value is low‐
ered, it might lead to a lot of small numbers of writes, which actually
only write to buffer cache and not immediately to the physical disk,
with the actual write happening later on. This might impact perfor‐
mance again.
What Other Tunable Values Should Be Changed at the Same Time?
None.
WARNINGS
All HP-UX kernel tunable parameters are release specific. This parame‐
ter may be removed or have its meaning changed in future releases of
HP-UX.
Installation of optional kernel software, from HP or other vendors, may
cause changes to tunable parameter values. After installation, some
tunable parameters may no longer be at the default or recommended val‐
ues. For information about the effects of installation on tunable val‐
ues, consult the documentation for the kernel software being installed.
For information about optional kernel software that was factory
installed on your system, see at
AUTHOR
was developed by HP.
SEE ALSOaudit(5).
Tunable Kernel Parameterdiskaudit_flush_interval(5)