audit

Kernel Parameters: 
 audit=1 audit_backlog_limit=8192 
 This prevents the message 
 kauditd: hold queue overflow