Auditd Daemon

The audit daemon is a simplified version of its desktop
counterpart designed to gather the audit logs from the
audit kernel subsystem. The audit subsystem of the kernel
includes Linux Security Modules (LSM) messages as well.

To enable the audit subsystem, you must add this to your
kernel config:
CONFIG_AUDIT=y

To enable a LSM, you must consult that LSM's documentation, the
example below is for SELinux:
CONFIG_SECURITY_SELINUX=y

This does not include possible dependencies that may need to be
satisfied for that particular LSM.

The properties that logd responds to are:

name                       type default  description
logd.auditd                 bool  true   Enable selinux audit daemon
logd.auditd.dmesg           bool  true   selinux audit messages duplicated and
                                         sent on to dmesg log
logd.statistics             bool depends Enable logcat -S statistics.
ro.config.low_ram           bool  false  if true, logd.statistics default false
ro.build.type               string       if user, logd.statistics default false
logd.statistics.dgram_qlen  bool  false  Record dgram_qlen statistics. This
                                         represents a performance impact and
                                         is used to determine the platform's
                                         minimum domain socket network FIFO
                                         size (see source for details) based
                                         on typical load (logcat -S to view)
persist.logd.size          number 256K   default size of the buffer for all
                                         log ids at initial startup, at runtime
                                         use: logcat -b all -G <value>
persist.logd.size.main     number 256K   Size of the buffer for the main log
persist.logd.size.system   number 256K   Size of the buffer for the system log
persist.logd.size.radio    number 256K   Size of the buffer for the radio log
persist.logd.size.event    number 256K   Size of the buffer for the event log
persist.logd.size.crash    number 256K   Size of the buffer for the crash log

NB:
- number support multipliers (K or M) for convenience. Range is limited
  to between 64K and 256M for log buffer sizes. Individual logs override the
  global default.