Linux auditing: Overhead and adaptation

Logging is a critical component of Linux auditing. The experiments indicate that the logging overhead can be significant. The paper aims to leverage the performance overhead introduced by Linux audit framework under various usage patterns. The study on the problem leads an adaptive audit logging mechanism. The adaptive auditing mechanism reduces the overall system overhead and achieves a similar level of protection on the system and network security.