In /var/log/kernellog we can see many entries for audit (since we have "space_left_action = SYSLOG" and "write_logs = no"):

audit: audit_backlog=32769 > audit_backlog_limit=32768
audit: audit_lost=1 audit_rate_limit=0 audit_backlog_limit=32768
audit: backlog limit exceeded

The Question: Could it be that a server crashes/stops if it cannot process the too much audit infos? FS holding kernellog having enough free space.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.