Role of "kauditd_printk_skb" in linux kernel

Question

I got this in my "dmesg" output:

kauditd_printk_skb: 10 callbacks suppressed

Can someone enlighten me on this "kauditd_printk_skb"? Essentially what does it do and how do I enumerate all the 10 callbacks which it has suppressed? And perhaps the reasons that goes with it?

Answer 1

Linux uses this mechanism to throttle the spamming of log events, decreasing the likelihood of a denial-of-service attack.

You can find tune this feature by amending two settings net.core.message_burst and net.core.message_cost.

These parameters are used to limit the warning messages written to the kernel log from the networking code. They enforce a rate limit to make a denial-of-service attack impossible. A higher message_cost factor, results in fewer messages that will be written. Message_burst controls when messages will be dropped. The default settings limit warning messages to one every five seconds.

To check their current values use:

sudo sysctl -a | grep net.core.message_

To amend them:

sysctl -w net.core.message_cost=0

Please note that disabling this mechanism is not recommend in production environments.

More information: https://www.kernel.org/doc/Documentation/sysctl/net.txt