Re: [PATCH-RFC] POSIX Event Logging, kernel 2.5.6 & 2.4.18

[Bernd Eckenfels]

In article <[e-mail]> you wrote:
> I assume that you mean do the nasty stuff but never have anything in
> your
> event log indicating that it happened.  Good point, but if the buffer is
> sized appropriately for the incoming volume of events and the logging
> daemon 
> is reading the events out of the kernel buffer (as should normally be
> the case), 
> then you would see the events.  

Well, depending on the type of events one can even think about a "halt" like
it is required for audit trail overflow.

What would be nice is a policy for each type of event:

- overwrite old/new/halt
- rate limit
- buffer size