Oracle Linux 10 – auditd backlog limit reached drops security events – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Security telemetry is incomplete because audit events are dropped under load.

Environment & Reproduction

Occurs on busy systems with dense audit rules and slow log forwarding.

systemctl status auditd
ausearch -m DAEMON_END -ts recent
cat /etc/audit/auditd.conf

Root Cause Analysis

Kernel backlog queue overflows when event production exceeds audit processing capacity.

Quick Triage

Check backlog status and lost event counters.

auditctl -s
ausearch -m DAEMON_CONFIG,DAEMON_ERR -ts recent

Step-by-Step Diagnosis

Measure rule volume and identify high cost watch entries.

auditctl -l | wc -l
aureport --summary
journalctl -u auditd -n 80

Solution – Primary Fix

Increase backlog limits and optimize excessive rule set entries.

grubby --update-kernel=ALL --args='audit_backlog_limit=8192'
systemctl restart auditd
auditctl -s

Solution – Alternative Approaches

Reduce noisy watches and offload logs faster to SIEM.

sed -n '1,120p' /etc/audit/rules.d/*.rules

Verification & Acceptance Criteria

Lost event count remains zero under normal workload.

auditctl -s
ausearch -m DAEMON_ERR -ts recent

Rollback Plan

Revert kernel argument and previous rules if instability appears.

grubby --update-kernel=ALL --remove-args='audit_backlog_limit=8192'
augenrules --load

Prevention & Hardening

Continuously profile audit rule cost and queue health.

aureport --summary
auditctl -s

Related Errors & Cross-Refs

Can overlap with rsyslog queue congestion and disk I O saturation.

Related tutorial: View the step-by-step tutorial for oracle-linux-10.

View all oracle-linux-10 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Oracle Linux auditing performance and compliance documentation.