logd: auditd: suppress multiple identical avc: messages to kmsg
Sends first and last of a series of 3 or more indentical avc: messages to kmsg and adds 'duplicate messages suppressed' for the last one in the set. eg: [67.141658] type=1400 audit(1468852100.171:70): avc: ... tcontext=u:object_r:proc:s0 tclass=file [67.141678] type=1400 audit(1468852107.494:71): avc: ... tcontext=u:object_r:cache_file:s0 tclass=dir [67.535202] type=1400 audit(1468852107.498:74): avc: ... tcontext=u:object_r:cache_file:s0 tclass=dir duplicate messages suppressed [67.535227] type=1400 audit(1468852107.888:75): avc: ... tcontext=u:object_r:proc_net:s0 tclass=file One can look at the sequence numbers in the above example to see that four identical message were produced, two were dropped. ToDo: Evaluate multiple streams of duplicate messages. Bug: 30118730 Change-Id: I31dcda7c8c42edfc7a8f1bf4d9e46284c74b3d18
Loading
Please register or sign in to comment