change default queue to 512

Author: stevegrubb

audisp/plugins/af_unix/af_unix.conf

@@ -9,6 +9,6 @@ active = no
 path = /sbin/audisp-af_unix
 type = always
 args = 0640 /run/audit/audispd_events string
-# To change the queue depth from the default of 800, append the value:
+# To change the queue depth from the default of 512, append the value:
 # args = 0640 /run/audit/audispd_events string 1000
 format = binary

audisp/plugins/af_unix/audisp-af_unix.8

@@ -9,7 +9,7 @@ audisp-af_unix \- plugin to push audit events to an af_unix socket
 .B args
 line of the 
 .B af_unix.conf
-file expects three arguments: access mode, socket path, and output format, and optionally a fourth argument specifying the queue depth. The access mode determines the permissions for the socket and defaults to 0640. The socket path specifies where the socket will be created, with the default location being /run/audit/audispd_events. The output format determines the format in which events are delivered to the socket and supports two options: "string" and "binary". The "string" format delivers events in a human-readable form, while the "binary" format delivers events in their binary representation, which is essential for applications that need to process events in binary and reconstruct headers accurately. If the output format is not specified, the plugin defaults to the "string" format. If no queue depth is specified, it defaults to 800.
+file expects three arguments: access mode, socket path, and output format, and optionally a fourth argument specifying the queue depth. The access mode determines the permissions for the socket and defaults to 0640. The socket path specifies where the socket will be created, with the default location being /run/audit/audispd_events. The output format determines the format in which events are delivered to the socket and supports two options: "string" and "binary". The "string" format delivers events in a human-readable form, while the "binary" format delivers events in their binary representation, which is essential for applications that need to process events in binary and reconstruct headers accurately. If the output format is not specified, the plugin defaults to the "string" format. If no queue depth is specified, it defaults to 512.
 
 The
 .B af_unix.conf

audisp/plugins/af_unix/audisp-af_unix.c

@@ -69,7 +69,7 @@ int inbound_protocol = -1;
 static struct mallinfo2 last_mi;
 #endif
 
-#define DEFAULT_QUEUE_DEPTH 800
+#define DEFAULT_QUEUE_DEPTH 512
 #define QUEUE_ENTRY_SIZE MAX_AUDIT_EVENT_FRAME_SIZE+1
 
 static size_t queue_depth = DEFAULT_QUEUE_DEPTH;