Auditd backlog limit exceeded under heavy load

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Audit events are dropped, creating compliance gaps and incomplete forensic trails.

Environment & Reproduction

RHEL 8 system with intensive syscall activity and strict audit ruleset.

Root Cause Analysis

Audit event volume exceeds processing throughput, backlog queue fills, and kernel starts dropping records.

Quick Triage

Check current audit status and dropped event counters before modifying policy or queue values.

Step-by-Step Diagnosis

Run `auditctl -s`, inspect `journalctl -u auditd`, and profile high-volume rules with `ausearch` sampling.

Solution – Primary Fix

Increase backlog limits, optimize noisy rules, ensure disk I/O capacity for logs, and restart auditd safely.

Solution – Alternative Approaches

Forward audit streams to dedicated collector nodes and split workloads to reduce per-host event pressure.

Verification & Acceptance Criteria

Dropped event count remains zero during peak load and compliance-required events are fully captured.

Rollback Plan

Restore prior audit rule and backlog settings if tuning negatively impacts system performance.

Prevention & Hardening

Continuously test audit policy at expected peak throughput and monitor queue depth metrics.

Related Errors & Cross-Refs

`audit: backlog limit exceeded`, dropped records, and delayed event write warnings.

Related tutorial: View the step-by-step tutorial for rhel-8.

View all rhel-8 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

RHEL security guide, auditd performance tuning notes, and `auditctl(8)` documentation.