How to recover error - Audit error: dispatch err (pipe full) event lost

How to recover error - Audit error: dispatch err (pipe full) event lost?

Solution Unverified - Updated -

Environment

  • Red Hat Enterprise Linux 7.3

Issue

  • Log file /var/log/messages showing audit error as below -

    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch error reporting limit reached - ending report notification.
    

Resolution

  • Edit /etc/audit/auditd.conf and set the value of disp_qos=lossy setting to disp_qos=lossless

    cat /etc/audit/auditd.conf  | grep disp_qos
    disp_qos=lossless 
    

Root Cause

  • The reason behind this error is that program is not pulling the events from the audit daemon fast enough.
0 (0)
Article Rating (No Votes)
Rate this article
Attachments
There are no attachments for this article.
Comments
There are no comments for this article. Be the first to post a comment.
Full Name
Email Address
Security Code Security Code
Related Articles RSS Feed
How to encrypt a partition with DM-Crypt LUKS on Linux
Viewed 1853 times since Fri, Jul 13, 2018
Watchdog script to keep an application running
Viewed 14406 times since Tue, Jul 31, 2018
ubuntu How to Reset Forgotten Root Password in Ubuntu
Viewed 1252 times since Tue, Dec 8, 2020
Need to set up yum repository for locally-mounted DVD on Red Hat Enterprise Linux 7
Viewed 2076 times since Mon, Oct 29, 2018
LOGROTATE – ARCHIWIAZACJA LOGÓW
Viewed 1178 times since Fri, Nov 30, 2018
RHEL: Reserved space on a ext2/ext3/ext4 filesystem
Viewed 3383 times since Sun, May 27, 2018
RHEL: XFS basic operations
Viewed 14023 times since Sat, Jun 2, 2018
HowTo: Create CSR using OpenSSL Without Prompt (Non-Interactive)
Viewed 12663 times since Mon, Feb 18, 2019
Method 2 – Use shell scripts How to install yum cron on a CentOS/RHEL 6.x/7.x
Viewed 1929 times since Tue, Dec 4, 2018
LVM: Reduce root PV/VG
Viewed 3818 times since Sat, Jun 2, 2018