RHEL 9 auditd backlog warnings and dropped audit events

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Audit subsystem warns about backlog and may drop security-relevant events.

Environment & Reproduction

Kernel or audit logs show backlog limit exceeded and event loss notifications.

Root Cause Analysis

Too many broad rules, slow disk writes, or insufficient queue settings.

Quick Triage

Use auditctl -s, check backlog values, and monitor write throughput.

Step-by-Step Diagnosis

Identify high-volume rule patterns generating excessive event load.

Solution – Primary Fix

Adjust auditd.conf and kernel audit backlog settings for workload profile.

Solution – Alternative Approaches

Ensure audit log target has adequate IOPS and low latency under peak load.

Verification & Acceptance Criteria

Restart auditd carefully during maintenance and verify active ruleset.

Rollback Plan

Maintain proper labels on audit log paths and protect against tampering.

Prevention & Hardening

Refine rules to retain compliance value without unnecessary duplicate events.

Related Errors & Cross-Refs

Capacity-plan audit throughput for new applications before production rollout.

Related tutorial: View the step-by-step tutorial for rhel-9.

View all rhel-9 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Observe sustained operation with no dropped-event warnings in logs.