What's the meaning of "audit: backlog limit exceeded"

8,672

I believe this occurs when kernel kauditd thread is not being able to service the audit records fast enough and a backlog occurs. The default audit backlog is 64 audit buffers, so it may help if these are increased. This can be set to be larger using the kernel parameter "audit_backlog_limit".

For example, edit /etc/default/grub and add audit_backlog_limit=256 to the GRUB_CMDLINE_LINUX setting and run sudo update-grub to set this to 256 buffers.

Share:
8,672

Related videos on Youtube

Nemo
Author by

Nemo

Updated on September 18, 2022

Comments

  • Nemo
    Nemo over 1 year

    I have a Ubuntu Server machine running Docker containers. I have some hard drives mounted for the Docker machines to use (mainly media storage)

    I installed Ubuntu Server with all defaults settings.
    I have on the screen many logs appearing:

    [59.959145] audit: backlog limit exceeded

    The lines are appearing randomly, and I have no idea what it means...