audit-3.0.3
This release improves performance reading events from the kernel. This will put more pressure on plugins, so default q_depth was tripled in size. Check your config, too. The behavior of auparse_feed_has_data in auparse was changed to include incomplete events. Add ProtectHome and RestrictRealtime to auditd.service. Some updates to the ids plugin.