RHEL 8 – auditd Backlog Limit Exceeded and Events Dropped

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Security audit records are dropped during load spikes, reducing forensic and compliance reliability.

Environment & Reproduction

Seen on busy RHEL 8 hosts with extensive audit rules and insufficient backlog sizing.

Root Cause Analysis

Kernel audit queue fills faster than auditd can process or forward events.

Quick Triage

Check auditd service state and kernel backlog messages with journalctl and dmesg.

Step-by-Step Diagnosis

Review audit backlog and lost event counters plus rule volume impact.

Solution – Primary Fix

Increase backlog limit, optimize noisy rules, and restart auditd during approved maintenance.

Solution – Alternative Approaches

Offload logs to dedicated collectors and use targeted rules for high-value events only.

Verification & Acceptance Criteria

Lost event counters stay at zero under representative load and audit pipeline remains healthy.

Rollback Plan

Revert auditd and kernel tuning values if performance or boot behavior regresses.

Prevention & Hardening

Baseline audit policy per role and continuously monitor queue depth and drop metrics.

Related Errors & Cross-Refs

audit: backlog limit exceeded, events lost, kauditd hold queue overflow.

Related tutorial: View the step-by-step tutorial for rhel-8.

View all rhel-8 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

RHEL 8 auditing, auditd tuning, and compliance logging architecture guidance.