Currently only one process does ingest from the netlink socket buffer. Messages come in parts making scaling the ingest difficult. Of the two was to scale pauditd (increase netlink buffer size, reduce latency in the rest of the pipeline) we do not have a way to get past large volumes and thus the system is lossy.
It would reduce the need for large netlink socket buffers that use system memory to bring the messages into userspace and store in user memory through localized buffers.
Currently only one process does ingest from the netlink socket buffer. Messages come in parts making scaling the ingest difficult. Of the two was to scale pauditd (increase netlink buffer size, reduce latency in the rest of the pipeline) we do not have a way to get past large volumes and thus the system is lossy.
It would reduce the need for large netlink socket buffers that use system memory to bring the messages into userspace and store in user memory through localized buffers.