How to recover error - Audit error: dispatch err (pipe full) event lost

How to recover error - Audit error: dispatch err (pipe full) event lost?

Solution Unverified - Updated -

Environment

  • Red Hat Enterprise Linux 7.3

Issue

  • Log file /var/log/messages showing audit error as below -

    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch error reporting limit reached - ending report notification.
    

Resolution

  • Edit /etc/audit/auditd.conf and set the value of disp_qos=lossy setting to disp_qos=lossless

    cat /etc/audit/auditd.conf  | grep disp_qos
    disp_qos=lossless 
    

Root Cause

  • The reason behind this error is that program is not pulling the events from the audit daemon fast enough.
0 (0)
Article Rating (No Votes)
Rate this article
Attachments
There are no attachments for this article.
Comments
There are no comments for this article. Be the first to post a comment.
Full Name
Email Address
Security Code Security Code
Related Articles RSS Feed
How to sort IP addresses in Linux
Viewed 2203 times since Sun, May 20, 2018
Configuring VLAN interfaces in Linux
Viewed 3084 times since Mon, May 21, 2018
RHEL: Crash kernel dumps configuration and analysis on RHEL 5
Viewed 5411 times since Sat, Jun 2, 2018
red hat 7 tmpfiles service
Viewed 807 times since Thu, Oct 11, 2018
Top 20 OpenSSH Server Best Security Practices - good article
Viewed 8015 times since Mon, Oct 1, 2018
How to use yum command on CentOS/RHEL
Viewed 9340 times since Wed, Oct 17, 2018
logrotate How log rotation works with logrotate
Viewed 7712 times since Sun, Jan 12, 2020
How to encrypt a partition using LUKS?
Viewed 918 times since Fri, Jul 13, 2018
RHEL: Adding a boot entry to GRUB/GRUB2 configuration
Viewed 1924 times since Sun, May 27, 2018
Linux How to reset a root password on Fedora
Viewed 638 times since Sun, Dec 6, 2020