[PATCH] Make "none" the default setting for vfs_full_audit

[Timur I. Bakeyev]

Hi!

Can I get a review, please?

With regards,
Timur.


On 2 July 2018 at 04:34, Timur I. Bakeyev <timur at freebsd.org> wrote:

> This patch is a suggestion to change the default behavior of the
> vfs_full_audit.
>
> Currently, by just adding the module to the list of VFS objects you enable
> auditing of ALL operations. We've observed with our end users that this
> almost instantly brings even moderately loaded server to it's knees.
>
> So, proposed patch turns off auditing of both successful and failed
> operations by default. It's still possible to audit ALL the operations by
> specifying "all" keyword, but practice shows that it's a bad idea unless
> you are doing it in the controlled test environment.
>
> With best regards,
> Timur Bakeyev.
>