1

In /var/log/kernellog we can see many entries for audit (since we have "space_left_action = SYSLOG" and "write_logs = no"):

...
audit: audit_backlog=32769 > audit_backlog_limit=32768
audit: audit_lost=1 audit_rate_limit=0 audit_backlog_limit=32768
audit: backlog limit exceeded
...

The Question: Could it be that a server crashes/stops if it cannot process the too much audit infos? FS holding kernellog having enough free space.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.