RHEL 8 auditd Log Flood Filling /var and Disrupting Services

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Disk usage spikes in /var due to excessive audit events, causing package operations, logging, and services to fail.

Environment & Reproduction

RHEL 8 systems with verbose audit rules and high file activity. Event volume exceeds rotation and archival capacity.

Root Cause Analysis

Broad watch rules and noisy syscall filters produce log amplification, while rotation limits are too small for peak event rates.

Quick Triage

Check df -h, auditctl -l, systemctl status auditd, and inspect journalctl for disk pressure and dropped event warnings.

Step-by-Step Diagnosis

Identify top-producing rules with ausearch summaries, correlate bursts to workloads, and confirm SELinux events are expected versus policy drift.

Solution – Primary Fix

Refine audit rules, increase rotation capacity, archive logs promptly, restart auditd with systemctl, and recover package updates through dnf after space is restored.

Solution – Alternative Approaches

Forward audit stream to centralized logging, segregate /var/audit on dedicated storage, or apply scoped policy exemptions where approved.

Verification & Acceptance Criteria

Log growth returns to normal, /var free space stabilizes, and system services operate without disk-related failures.

Rollback Plan

Reinstate previous audit rules if compliance requires, while temporarily expanding storage and increasing rotation frequency.

Prevention & Hardening

Implement audit rate monitoring and storage thresholds with proactive alerts before service impact occurs.

Related Errors & Cross-Refs

Related issues include journald disk exhaustion, rsyslog queue buildup, and failed dnf transactions due to no space left.

Related tutorial: View the step-by-step tutorial for rhel-8.

View all rhel-8 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

See Red Hat audit subsystem docs, auditctl manuals, and compliance logging standards.