RHEL 10 – auditd backlog limit exceeded and security events lost – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Kernel reports lost audit events when backlog is exhausted, reducing forensic integrity.

Environment & Reproduction

Appears under heavy syscall activity and strict auditing profiles.

systemctl status auditd
auditctl -s
journalctl -k | grep -i audit

Root Cause Analysis

Backlog limits and flush strategy are too low for event throughput and storage latency.

Quick Triage

Check immediate drop counters and disk condition.

auditctl -s
df -h /var/log/audit
ausearch -m DAEMON_END,DAEMON_START -ts recent

Step-by-Step Diagnosis

Inspect audit daemon settings and kernel boot args.

grep -E 'backlog|flush|freq' /etc/audit/auditd.conf
cat /proc/cmdline | tr ' ' 'n' | grep audit
augenrules --check

Solution – Primary Fix

Raise kernel and auditd backlog settings and restart service.

sudo grubby --update-kernel=ALL --args='audit_backlog_limit=8192'
sudo sed -i 's/^flush.*/flush = INCREMENTAL_ASYNC/' /etc/audit/auditd.conf
sudo systemctl restart auditd

Solution – Alternative Approaches

Trim noisy rules and separate high-volume watch paths.

sudo ausearch -ts recent | wc -l
sudo augenrules --load

Verification & Acceptance Criteria

No new dropped-event messages and stable audit queue behavior.

auditctl -s
journalctl -k -n 100 --no-pager | grep -i audit
ausearch -m AVC -ts recent | head

Rollback Plan

Remove added kernel arg and restore prior auditd.conf if side effects appear.

sudo grubby --update-kernel=ALL --remove-args='audit_backlog_limit=8192'
sudo cp /etc/audit/auditd.conf.bak /etc/audit/auditd.conf
sudo systemctl restart auditd

Prevention & Hardening

Continuously monitor dropped audit events and tune per workload profile.

auditctl -s
systemctl enable --now auditd

Related Errors & Cross-Refs

Related to rsyslog congestion, slow storage, and excessive watch rules on busy directories.

Related tutorial: View the step-by-step tutorial for rhel-10.

View all rhel-10 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

RHEL security and auditing documentation for backlog management and rule optimization.