auditd stops because /var/log/audit is full

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Security auditing degrades or halts, creating compliance gaps and missing forensic data.

Environment & Reproduction

RHEL 7 with high event rates fills /var/log/audit and triggers auditd pressure actions.

Root Cause Analysis

Insufficient retention tuning, oversized rule set, or slow archival processing.

Quick Triage

Check disk usage and auditd status with systemctl status auditd and ausearch test query.

Step-by-Step Diagnosis

Inspect /etc/audit/auditd.conf thresholds, review journalctl -u auditd, and measure event burst sources.

Solution – Primary Fix

Free space, tune max_log_file and num_logs, rotate logs, then restart auditd safely.

Solution – Alternative Approaches

Forward audit stream to centralized SIEM and reduce local retention footprint.

Verification & Acceptance Criteria

auditd remains active, new events are recorded, and space remains above policy threshold.

Rollback Plan

Restore prior auditd.conf and log set if tuned values conflict with compliance requirement.

Prevention & Hardening

Set alerting for audit partition growth and periodically review noisy audit rules.

Related Errors & Cross-Refs

Audit daemon is low on disk space, backlog limit exceeded, audit logging suspended.

Related tutorial: View the step-by-step tutorial for rhel-7.

View all rhel-7 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

auditd.conf man page, RHEL security auditing guide, SIEM integration recommendations.