You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
So far, Laure's mode of operation has been pretty linear:
Reaad auditd record from stdin, parse, coalesce, transform, enrich, output, repeat.
Any extra I/O it had to do had to do with reading from /proc. This worked fine as long as the only other entity involved was the Linux kerrnel, but that is going to change as we will want to add information provided by container runtimes or other sources.
Async I/O would be useful to avoid backpressure causing auditd to stop sending events on systems with high load. It would also be useful for socket-based output channels.
The text was updated successfully, but these errors were encountered:
Just sprinkling async and await all across the codebase will not work since it would incur a large performance hit. (Tried that, measured it, ,abandoned the idea.)
So far, Laure's mode of operation has been pretty linear:
Reaad auditd record from stdin, parse, coalesce, transform, enrich, output, repeat.
Any extra I/O it had to do had to do with reading from
/proc
. This worked fine as long as the only other entity involved was the Linux kerrnel, but that is going to change as we will want to add information provided by container runtimes or other sources.Async I/O would be useful to avoid backpressure causing auditd to stop sending events on systems with high load. It would also be useful for socket-based output channels.
The text was updated successfully, but these errors were encountered: