When a user/process hits a ulimit is there a way to log this at the system level? I cannot find any logging information in /var/log/messages, or dmesg. I did some preliminary research and the answer is that the application has to 'detect' this; is there a way to just globally log when these limits are reached?



The above is an attempt to monitor failed syscalls with auditd and then determine when/if that was due to ulimit - I think that's as close as you can get without modifying the kernel and/or PAM to directly dump such events to log.

  • do the auditd rules persist between reboot, or do they need to be run every time – xenoterracide Feb 6 '18 at 15:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.