or do you only enable a subset of audit events for things yo

Question

or do you only enable a subset of audit events for things you truly care about e g `process event`

clong · Answer

it really depends on how busy the host will be and how many syscalls will be generated

clong · Answer

and obviously the hardware specs of the host

Zach Zeid · Answer

Is there a way I can understand the perf impact of enabling these