Hi Heinrich, Would you be able to take a look at https://bugzilla.kernel.org/show_bug.cgi?id=198569 It relates to some text you added to the fanotify_mark(2) manual page: FAN_Q_OVERFLOW Create an event when an overflow of the event queue occurs. The size of the event queue is limited to 16384 entries if FAN_UNLIMITED_QUEUE is not set in fanotify_init(2). This was in the following commit [[ commit 5d730f864a6603b090cd1078668cede05d02b8c4 Author: Heinrich Schuchardt <xypron.glpk@xxxxxx> Date: Tue Nov 8 23:13:38 2016 +0100 fanotify_mark.2: Mention FAN_Q_OVERFLOW To receive overflow events it is necessary to set this bit in fanotify_mark(). ]] As far as I can see, FAN_Q_OVERFLOW (test program, reading the kernel source) is only an output flag. But on the other hand, I know you are generally careful, so I wonder if something changed (though, at a quick glance, I could not see evidence that it has). Thanks, Michael -- Michael Kerrisk Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/ Linux/UNIX System Programming Training: http://man7.org/training/