NAME
diskaudit_flush_interval — determine time interval (in secs) for flushing audit records
DESCRIPTION
The tunable
diskaudit_flush_interval
controls the periodic interval between two consecutive flushes of audit
records buffered in the kernel memory which is bound to a kernel thread.
This kernel thread has 64KB of buffer size to hold the audit records,
and there can be a maximum of 32 such threads.
These kernel threads automatically flush their buffers if the buffers
fill up completely, but that might take a long time
depending upon the activities in the system.
The value of the tunable should be set
such that the threads keep cleaning their buffers when they are approximately
half full, or are idle for a long time but still holding some data in the
buffer.
Keeping the tunable value too low will make threads flush
too soon and may lead to too many small write operations, thus impacting
performance.
On the other hand, keeping the value too high might lead to high
unflushed memory consumption.
Who Is Expected to Change This Tunable?
An administrator with proper privileges can change the
value of
diskaudit_flush_interval.
Restrictions on Changing
None.
This tunable is dynamic.
When Should the Value of This Tunable Be Raised?
When the system is not processing many audit-related activities.
What are the Side Effects of Raising the Value?
If the system is generating large numbers of records, and the value is
raised, then it can result in a lot of unflushed memory, and might slow
down the system.
When Should the Value of This Tunable Be Lowered?
When the system is generating a lot of audit records.
What are the Side Effects of Lowering the Value?
If the system is not generating too many records, and the value is lowered,
it might lead to a lot of small numbers of writes, which actually only
write to buffer cache and not immediately to the physical disk,
with the actual write happening later on.
This might impact performance again.
What Other Tunable Values Should Be Changed at the Same Time?
None.
WARNINGS
All HP-UX kernel tunable parameters are release specific.
This parameter may be removed or have its meaning changed in
future releases of HP-UX.
Installation of optional kernel software, from HP or other vendors,
may cause changes to tunable parameter values.
After installation,
some tunable parameters may no longer be at the default or
recommended values.
For information about the effects of
installation on tunable values, consult the documentation
for the kernel software being installed.
For information about optional kernel software that was
factory installed on your system, see
HP-UX Release Notes
at
http://docs.hp.com.
AUTHOR
diskaudit_flush_interval
was developed by HP.
Printable version
