RHEL 8 auditd Backlog Limit Exceeded and Events Lost

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

audit logs report backlog limit exceeded and dropped events, weakening forensic and compliance evidence. Security monitoring loses critical visibility.

Environment & Reproduction

High syscall volume workloads with strict audit rules trigger this under load spikes. Events are lost during bursts or storage slowdowns.

Root Cause Analysis

auditd cannot process queued kernel events fast enough due to low backlog limits, expensive rules, or I/O bottlenecks on log storage.

Quick Triage

Inspect ausearch and audit logs for lost event counters, then check system load and disk latency. Review journalctl for auditd throttling messages.

Step-by-Step Diagnosis

Measure event throughput, profile heavy rules, and validate current backlog parameters from boot args and auditd configuration. Identify contention on /var/log/audit.

Solution – Primary Fix

Increase backlog limits appropriately, optimize audit rules, and ensure sufficient disk performance. Restart auditd safely and verify reduced drop counts.

Solution – Alternative Approaches

Offload logs to remote collectors, split noisy workloads, or adopt adaptive audit policies for non-critical event categories.

Verification & Acceptance Criteria

No new backlog overflow warnings appear under normal peak load and event continuity is preserved.

Rollback Plan

Revert tuning parameters if kernel memory pressure or unexpected behavior occurs, then re-evaluate ruleset complexity.

Prevention & Hardening

Continuously monitor audit queue metrics, test rules in staging, and baseline throughput per host role.

Related Errors & Cross-Refs

Correlate with disk saturation, journald pressure, and CPU starvation when diagnosing persistent audit drops.

Related tutorial: View the step-by-step tutorial for rhel-8.

View all rhel-8 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Consult Red Hat audit subsystem documentation and compliance tuning recommendations for RHEL 8.