Auditd Stops Logging Due to Disk Full Condition

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Security audit records stop or degrade when audit log partition fills, creating compliance and forensic gaps.

Environment & Reproduction

RHEL 8 with auditd enabled and local log retention under /var/log/audit.

Root Cause Analysis

Insufficient log rotation, runaway audit volume, or inadequate partition sizing for event throughput.

Quick Triage

Check df -h, auditctl -s, and /etc/audit/auditd.conf values for max_log_file and disk action thresholds.

Step-by-Step Diagnosis

Inspect /var/log/audit/audit.log and journalctl -u auditd for low-space actions and queue behavior.

Solution – Primary Fix

Free space safely, tune auditd.conf rotation thresholds, restart with systemctl restart auditd, and verify logging resumes.

Solution – Alternative Approaches

Generate test auditable event and confirm it appears in audit logs and SIEM ingestion pipeline.

Verification & Acceptance Criteria

Temporarily redirect or forward logs to centralized storage if local partition cannot be expanded quickly.

Rollback Plan

Model audit event volume, size partitions accordingly, and enforce proactive retention/archival policies.

Prevention & Hardening

Audit logging continuity is mandatory for many frameworks; treat logging interruption as high severity incident.

Related Errors & Cross-Refs

Deploy disk-capacity and audit backlog alerts that trigger well before action_disk_error thresholds.

Related tutorial: View the step-by-step tutorial for rhel-8.

View all rhel-8 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

auditd.conf(5), auditctl(8), and RHEL 8 security auditing administration references.