You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When enhanced session recording is enabled, all session commands and other BPF events should be recorded.
Current behavior:
The BPF service can be overloaded and miss events. It was surprisingly easy to overload on a virtual Centos7 box with Kernel 5.15.171 manually installed, 16gb ram and 16 cores.
Running while sleep .5; do ls; done, I would get the following error every several seconds, and it would affect all events for a few seconds, like the service is temporarily overloaded and down. These missing events would occur in the session, but would not be recorded in the audit log.
Expected behavior:
When enhanced session recording is enabled, all session commands and other BPF events should be recorded.
Current behavior:
The BPF service can be overloaded and miss events. It was surprisingly easy to overload on a virtual Centos7 box with Kernel 5.15.171 manually installed, 16gb ram and 16 cores.
Running
while sleep .5; do ls; done
, I would get the following error every several seconds, and it would affect all events for a few seconds, like the service is temporarily overloaded and down. These missing events would occur in the session, but would not be recorded in the audit log.Bug details:
The text was updated successfully, but these errors were encountered: