auditd Stops Logging Because Disk Threshold Is Hit

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Security audits show logging gaps and auditd reports suspended or no-space conditions.

Environment & Reproduction

Audit partition reached configured space_left or admin_space_left thresholds.

Root Cause Analysis

Run df -h /var/log/audit, sudo systemctl status auditd, and inspect /etc/audit/auditd.conf.

Quick Triage

Free immediate space by archiving old audit logs according to retention policy.

Step-by-Step Diagnosis

Adjust rotation and threshold values in auditd.conf, then restart auditd safely.

Solution – Primary Fix

Confirm new events are written with sudo ausearch -ts recent and active auditd state.

Solution – Alternative Approaches

Verify continuous event capture and no further suspend actions in journalctl.

Verification & Acceptance Criteria

Revert threshold changes if compliance policy requires stricter limits and expand storage.

Rollback Plan

Allocate dedicated audit volume and enforce predictable retention and offloading.

Prevention & Hardening

Alert on audit log utilization and auditd status before thresholds trigger service impact.

Related Errors & Cross-Refs

Schedule secure archival and upload jobs for audit logs with integrity checks.

Related tutorial: View the step-by-step tutorial for rhel-9.

View all rhel-9 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Consult auditd.conf, ausearch, and RHEL 9 security compliance documentation.