kernel print rate limiting from auditd

Hi folks, I keep getting the following messages from the kernel:

kauditd_printk_skb: 485 callbacks suppressed

I couldn't find kauditd or auditd for that matter when searching through pacman pacman -Ss auditd which leads me to the following questions:

  1. Is auditd packaged inside the kernel?
  2. Is there any way to increase the rate limiting in order to fix the suppressed callbacks?


Part of systemd (I think), though userspace tools are a separate package:

It may be part of the kernel which systemd is exposing but isn't actually handling correctly...

Worth reading:


Thank you jonathon for the references!