How to recover error - Audit error: dispatch err (pipe full) event lost

How to recover error - Audit error: dispatch err (pipe full) event lost?

Solution Unverified - Updated -

Environment

  • Red Hat Enterprise Linux 7.3

Issue

  • Log file /var/log/messages showing audit error as below -

    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch error reporting limit reached - ending report notification.
    

Resolution

  • Edit /etc/audit/auditd.conf and set the value of disp_qos=lossy setting to disp_qos=lossless

    cat /etc/audit/auditd.conf  | grep disp_qos
    disp_qos=lossless 
    

Root Cause

  • The reason behind this error is that program is not pulling the events from the audit daemon fast enough.
0 (0)
Article Rating (No Votes)
Rate this article
Attachments
There are no attachments for this article.
Comments
There are no comments for this article. Be the first to post a comment.
Full Name
Email Address
Security Code Security Code
Related Articles RSS Feed
How to enable Proxy Settings for Yum Command on RHEL / CentOS Servers
Viewed 11971 times since Thu, Jul 19, 2018
20 Linux Command Tips and Tricks That Will Save You A Lot of Time linux
Viewed 4331 times since Thu, Apr 18, 2019
RHEL: Checking HBAs
Viewed 14301 times since Sun, May 27, 2018
stunnel How To Encrypt Traffic to Redis with Stunnel on Ubuntu 16.04
Viewed 1817 times since Sun, Dec 6, 2020
RHCS6: Quorum disk and heuristics
Viewed 3909 times since Sun, Jun 3, 2018
Stunnel Setup
Viewed 17395 times since Fri, Sep 28, 2018
Inxi: Find System And Hardware Information On Linux
Viewed 2017 times since Sat, Jun 2, 2018
How To Run Multiple SSH Command On Remote Machine And Exit Safely
Viewed 3917 times since Tue, Aug 6, 2019
Red Hat ADDING SWAP SPACE
Viewed 1825 times since Fri, Jun 8, 2018
stunnel bacula
Viewed 1835 times since Fri, Sep 28, 2018