Oracle Linux 10 – auditd log flood causes high I/O and delayed journald processing – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Excessive audit events saturate disk IO and delay log availability for incident triage.

Environment & Reproduction

Triggered by broad syscall watches or runaway denied operations.

ausearch -ts recent | wc -l
journalctl -n 20 --no-pager

Root Cause Analysis

Overly verbose audit rules and repeated denials flood both audit and journal pipelines.

Quick Triage

Confirm service health and identify top event sources.

systemctl status auditd
systemctl status systemd-journald
journalctl -u auditd -n 80 --no-pager
getenforce
firewall-cmd --state

Step-by-Step Diagnosis

Measure event rates and locate noisy rules or binaries.

aureport --summary -i | head -n 40
auditctl -l
ausearch -m avc -ts recent | tail -n 80

Solution – Primary Fix

Reduce noisy rule scope, rotate logs, and tune audit backlog parameters.

sudo augenrules --load
sudo sed -i 's/^max_log_file_action.*/max_log_file_action = ROTATE/' /etc/audit/auditd.conf
sudo systemctl restart auditd
sudo systemctl restart systemd-journald

Solution – Alternative Approaches

Forward high-volume events to dedicated logging nodes and keep local policy minimal.

sudo dnf install audispd-plugins -y
sudo systemctl restart auditd

Verification & Acceptance Criteria

Event ingestion remains timely and disk pressure returns to normal.

iostat -x 1 5
journalctl --since '-10 min' | wc -l

Rollback Plan

Restore prior audit configuration from backup and reload rule set.

sudo cp /root/backup/auditd.conf /etc/audit/auditd.conf
sudo cp /root/backup/*.rules /etc/audit/rules.d/
sudo augenrules --load

Prevention & Hardening

Review audit rule changes with performance gates before production rollout.

aureport --failed -i | head -n 30

Related Errors & Cross-Refs

Related to SELinux denial storms and rsyslog queue backpressure.

Related tutorial: View the step-by-step tutorial for oracle-linux-10.

View all oracle-linux-10 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

auditd performance tuning and Red Hat logging architecture references.