🟡 Medium   ⏱ 5–30 min  Last verified: 20 May 2026
Affected versions: CentOS Stream 9

📖 ~1 min read

Table of contents
  1. Symptom & Impact
  2. Environment & Reproduction
  3. Root Cause Analysis
  4. Quick Triage
  5. Step-by-Step Diagnosis
  6. Solution – Primary Fix
  7. Solution – Alternative Approaches
  8. Verification & Acceptance Criteria
  9. Rollback Plan
  10. Prevention & Hardening
  11. Related Errors & Cross-Refs
  12. References & Further Reading

Symptom & Impact

auditd reports kernel audit messages lost on CentOS Stream 9.

Environment & Reproduction

Compliance-focused hosts with high syscall volume.

cat /etc/os-release
uname -r
rpm -qa | grep

Root Cause Analysis

Audit backlog limit too small or auditd disk_full_action misconfigured.

Quick Triage

Confirm package, network, SELinux and firewall state.

auditctl -s
auditctl -l
df -h /var/log/audit

Step-by-Step Diagnosis

Drill into audit/auditd state and recent journal entries to isolate the failure.

journalctl -u auditd -n 80
ausearch -m DAEMON -ts today
Illustrative mockup for centos-stream-9 — cs9-b02-p050-diag
Diagnosis console for auditd buffer overflow drops events on CentOS Stream 9 — Illustrative mockup — Progressive Robot

Solution – Primary Fix

Apply the standard remediation for audit/auditd on CentOS Stream 9.

Still having issues? Our IT Solutions & Services team can diagnose and resolve this for you. Get in touch for a free consultation.

sudo auditctl -b 16384
sudo sed -i 's/^max_log_file =.*/max_log_file = 100/' /etc/audit/auditd.conf
sudo systemctl restart auditd
Illustrative mockup for centos-stream-9 — cs9-b02-p050-fix
Remediation output for auditd buffer overflow drops events on CentOS Stream 9 — Illustrative mockup — Progressive Robot

Solution – Alternative Approaches

Forward audit events to remote audit collector via audisp-remote.

Verification & Acceptance Criteria

Validate the fix with positive functional checks before closing.

auditctl -s
ausearch -m AVC -ts recent

Rollback Plan

Revert to the previous known-good configuration if the fix regresses.

cp /root/backup/auditd.conf /etc/audit/auditd.conf
systemctl restart auditd

Prevention & Hardening

Codify the fix in configuration management and add monitoring.

Monitor backlog watermark via Prometheus.

SELinux AVC denials missing from logs.

Related tutorial: View the step-by-step tutorial for centos-stream-9.

View all centos-stream-9 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

auditd documentation.

Need Expert Help?

If you cannot resolve this yourself, our team offers hands-on Server Management, Managed IT Services, and flexible Support Plans. Contact us today — we respond within one business day.