The following patch introduced behaviour where a user has the default buffer size of new pipes changed if the total amount of memory used by pipes exceeds a threshold.
https://lkml.org/lkml/2016/1/18/171
Is there a way to use auditd to trigger on this limit being exceeded.
Thx