Auditd Backlog Overflow Drops Critical Security Events

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Required audit records are missing, affecting forensic completeness.

Environment & Reproduction

High syscall throughput with strict audit rules enabled.

Root Cause Analysis

Audit queue and processing path cannot keep pace with event volume.

Quick Triage

Review dmesg and /var/log/audit/audit.log for backlog warnings.

Step-by-Step Diagnosis

Inspect backlog_limit, rate_limit, disk write latency, and plugin performance.

Solution – Primary Fix

Tune auditd and kernel audit parameters, then restart auditd carefully.

Solution – Alternative Approaches

Reduce noisy rules and offload logs to high-throughput storage.

Verification & Acceptance Criteria

No backlog overflow messages and expected events are recorded.

Rollback Plan

Reapply previous auditd.conf and rule set from backup.

Prevention & Hardening

Capacity-test audit policies before production rollout.

Related Errors & Cross-Refs

audit: backlog limit exceeded, events may be lost.

Related tutorial: View the step-by-step tutorial for oracle-linux-10.

View all oracle-linux-10 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

auditd and Linux audit subsystem tuning guides.