RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Description of problem:
Some of the RHEL default fapolicyd config values are unintuitive.

Upstream default for db_max_size is 100, Steve said 50 was needed in his environment, but RHEL RPM uses 40. Is it really worth trying to save 10MB here if that's not adequate enough in some environments? How about syncing upstream and the RHEL default?

obj_cache_size default is 4096 but RHEL default is 8191 (sic). If db_max_size was minimal compared to upstream then why is this doubled? And why 8191 instead of 8192?

I'm not qualified to review all the default values but I'd hope the RHEL/upstream defaults would be more in sync and there would be some consistency in setting non-default values on RHEL (e.g., why minimize one when doubling the other).

Version-Release number of selected component (if applicable):
fapolicyd-1.1-1.el8.x86_64

The value 8191 is chosen because it is a prime number. Prime numbers are recommended to prevent collisions in the LRU lookup. This is documented in the performance part of README.md. The default values you are seeing are simply old values from old packages. Newer packages have newer numbers.

Closing with CURRENT RELEASE resolution.

Also, one last thing...faploicyd-1.1.4 adds --check-status to fapolicyd-cli so that you can see at any time what metrics the daemon is keeping.