Skip to content

audit-3.0.3

Compare
Choose a tag to compare
@stevegrubb stevegrubb released this 14 Jul 18:39
· 502 commits to master since this release

This release improves performance reading events from the kernel. This will put more pressure on plugins, so default q_depth was tripled in size. Check your config, too. The behavior of auparse_feed_has_data in auparse was changed to include incomplete events. Add ProtectHome and RestrictRealtime to auditd.service. Some updates to the ids plugin.