FreeBSD 14 – auditd Queue Overflow Drops Security Events – Event Pipeline Recovery

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Security audit events are dropped during bursts, creating compliance blind spots.

Environment & Reproduction

Observed on busy systems with verbose audit classes and slow log processing.

audit -s
auditstat

Root Cause Analysis

Audit queue depth and disk/log throughput are insufficient for event volume.

Quick Triage

Confirm drop counters and relieve immediate pressure by narrowing audit classes.

auditstat -c 5
cat /etc/security/audit_control

Step-by-Step Diagnosis

Profile queue behavior, log rotation latency, and post-processing bottlenecks.

tail -n 120 /var/audit/* 2>/dev/null
newsyslog -n

Solution – Primary Fix

Increase queue tolerance, optimize rotation, and restart auditing services.

cp /etc/security/audit_control /etc/security/audit_control.bak.$(date +%F)
vi /etc/security/audit_control
service auditd restart

Solution – Alternative Approaches

Offload audit streams to centralized collection with faster storage.

Verification & Acceptance Criteria

Drop counters remain at zero under expected production load levels.

auditstat -c 10

Rollback Plan

Restore previous audit policy if narrowed classes omit required controls.

Prevention & Hardening

Capacity-plan audit throughput and alert on queue depth saturation early.

Related Errors & Cross-Refs

audit queue full, records dropped, auditd backlog overflow.

Related tutorial: View the step-by-step tutorial for freebsd-14.

View all freebsd-14 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

FreeBSD audit subsystem docs and security logging architecture guidance.