RHEL 8 auditd Backlog Limit Exceeded and Events Lost – RHEL 8 Post 073

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

RHEL 8 logs indicate audit backlog overflow and dropped events, reducing forensic visibility and potentially violating compliance requirements.

Environment & Reproduction

Seen on high syscall-rate hosts with strict auditing rules and limited throughput for event processing. Reproduce under synthetic high event load.

Root Cause Analysis

Backlog queue fills faster than userspace can drain due to rule volume, storage latency, or undersized queue limits. Burst activity amplifies loss risk.

Quick Triage

Check auditctl status, systemctl status auditd, journalctl -u auditd, and disk performance. Validate SELinux and firewalld changes are not adding unusual noise.

Step-by-Step Diagnosis

Measure event rate, profile expensive audit rules, inspect dispatcher latency, and identify whether queue saturation is persistent or burst-driven.

Solution – Primary Fix

Increase backlog limits appropriately, optimize audit rule set, ensure storage throughput is sufficient, and restart auditd safely. Confirm event loss counters stop increasing.

Solution – Alternative Approaches

Forward audit streams to faster collectors, reduce nonessential rule scope, or split high-activity workloads to separate nodes with tuned policies.

Verification & Acceptance Criteria

No new backlog overflow messages occur, event capture remains complete under expected load, and compliance checks pass.

Rollback Plan

Restore previous audit settings if side effects appear, then reintroduce tuned values incrementally with monitoring.

Prevention & Hardening

Capacity plan audit pipelines, benchmark rule cost before rollout, and alert early on backlog growth and dispatcher lag.

Related Errors & Cross-Refs

Related to journald I/O saturation, disk bottlenecks, and overly broad security policy instrumentation causing log storms.

Related tutorial: View the step-by-step tutorial for rhel-8.

View all rhel-8 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

auditd and auditctl man pages, Red Hat security hardening docs, and journalctl references for service-level diagnostics.