RHEL 10 – auditd service fails because audit partition is full – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Security auditing stops, reducing compliance visibility and incident traceability.

Environment & Reproduction

Common on high-event systems without aggressive audit log rotation.

systemctl status auditd
df -h /var/log/audit
ausearch -m daemon_end -ts today

Root Cause Analysis

Audit log volume exceeds configured retention and partition capacity.

Quick Triage

Confirm disk exhaustion and auditd failure mode.

journalctl -u auditd -n 100
ls -lh /var/log/audit
cat /etc/audit/auditd.conf

Step-by-Step Diagnosis

Review rotate settings and identify noisy audit rules.

grep -E 'max_log_file|max_log_file_action|space_left_action' /etc/audit/auditd.conf
auditctl -l
ausearch -ts today | wc -l

Solution – Primary Fix

Archive old logs, tune retention, and restart auditd.

service auditd stop
tar -czf /root/audit-archive-$(date +%F).tgz /var/log/audit/audit.log.*
rm -f /var/log/audit/audit.log.*
service auditd start

Solution – Alternative Approaches

Forward audit events centrally and reduce local retention window.

sed -i 's/^max_log_file =.*/max_log_file = 32/' /etc/audit/auditd.conf
service auditd restart

Verification & Acceptance Criteria

auditd remains active and new events are captured with sufficient free space.

systemctl is-active auditd
df -h /var/log/audit
ausearch -m USER_LOGIN -ts recent | head

Rollback Plan

Restore previous auditd.conf if tuned retention violates compliance policy.

cp -a /etc/audit/auditd.conf.bak /etc/audit/auditd.conf
service auditd restart

Prevention & Hardening

Implement capacity alerts and controlled audit rule volume.

journalctl -k | grep -i audit | tail -n 50
auditctl -s

Related Errors & Cross-Refs

Related to journald growth and logrotate misconfiguration.

Related tutorial: View the step-by-step tutorial for rhel-10.

View all rhel-10 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

RHEL audit subsystem tuning and retention management guidance.