How to recover error - Audit error: dispatch err (pipe full) event lost

How to recover error - Audit error: dispatch err (pipe full) event lost?

Solution Unverified - Updated -

Environment

  • Red Hat Enterprise Linux 7.3

Issue

  • Log file /var/log/messages showing audit error as below -

    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch error reporting limit reached - ending report notification.
    

Resolution

  • Edit /etc/audit/auditd.conf and set the value of disp_qos=lossy setting to disp_qos=lossless

    cat /etc/audit/auditd.conf  | grep disp_qos
    disp_qos=lossless 
    

Root Cause

  • The reason behind this error is that program is not pulling the events from the audit daemon fast enough.
0 (0)
Article Rating (No Votes)
Rate this article
Attachments
There are no attachments for this article.
Comments
There are no comments for this article. Be the first to post a comment.
Full Name
Email Address
Security Code Security Code
Related Articles RSS Feed
How to Migrate from RHEL 8 to CentOS 8
Viewed 1063 times since Fri, May 15, 2020
RHCS6: ’fencing’ basics
Viewed 1185 times since Sun, Jun 3, 2018
How to Install and use Lsyncd on CentOS 7 / RHEL 7 rsync
Viewed 2328 times since Wed, Oct 31, 2018
Extending Linux LVM partitions script
Viewed 5289 times since Wed, Feb 6, 2019
HP-UX - Stunnel Configuration
Viewed 1069 times since Fri, Sep 28, 2018
How To Use the Linux Auditing System on CentOS 7
Viewed 1861 times since Fri, Apr 5, 2019
LVM: Recovering Physical Volume Metadata
Viewed 11620 times since Sat, Jun 2, 2018
Szybkie sprawdzenie zewnętrznego adresu IP i hosta
Viewed 1765 times since Thu, May 24, 2018
RHEL7: How to get started with Firewalld.
Viewed 8922 times since Wed, May 22, 2019
RHCS6: Debug and test multicast traffic between two hosts
Viewed 4168 times since Sun, Jun 3, 2018