RHEL 9 Auditd Log Flood Causes Performance Degradation

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Excessive audit events on RHEL 9 consume CPU and I/O, impacting application performance.

Environment & Reproduction

High system load, rapid growth of /var/log/audit, and delayed response from monitored services.

Root Cause Analysis

Overly broad audit rules, low backlog thresholds, or event storms from noisy processes.

Quick Triage

Check auditd status, event rates, and top rule triggers before applying tuning changes.

Step-by-Step Diagnosis

Refine audit scope to required compliance controls and remove redundant broad watch patterns.

Solution – Primary Fix

Adjust backlog and rotation settings, then restart auditd carefully to apply policy.

Solution – Alternative Approaches

Manage restart windows with systemctl to avoid losing critical telemetry during high-risk periods.

Verification & Acceptance Criteria

Ensure audit log paths keep proper labels so collection and rotation continue without denials.

Rollback Plan

Use journalctl alongside audit logs to correlate spikes with specific services or deployment events.

Prevention & Hardening

Set practical retention and forwarding to SIEM so local disks are protected from bursts.

Related Errors & Cross-Refs

After tuning, verify compliance-required events still capture correctly while system performance improves.

Related tutorial: View the step-by-step tutorial for rhel-9.

View all rhel-9 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Review audit rule sets quarterly and test against realistic workload telemetry before production rollout.