How to recover error - Audit error: dispatch err (pipe full) event lost

How to recover error - Audit error: dispatch err (pipe full) event lost?

Solution Unverified - Updated -

Environment

  • Red Hat Enterprise Linux 7.3

Issue

  • Log file /var/log/messages showing audit error as below -

    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch err (pipe full) event lost
    dispatch error reporting limit reached - ending report notification.
    

Resolution

  • Edit /etc/audit/auditd.conf and set the value of disp_qos=lossy setting to disp_qos=lossless

    cat /etc/audit/auditd.conf  | grep disp_qos
    disp_qos=lossless 
    

Root Cause

  • The reason behind this error is that program is not pulling the events from the audit daemon fast enough.
0 (0)
Article Rating (No Votes)
Rate this article
Attachments
There are no attachments for this article.
Comments
There are no comments for this article. Be the first to post a comment.
Full Name
Email Address
Security Code Security Code
Related Articles RSS Feed
stunnel Howto A Guide to create SSL access to a HTTP-only webserver with stunnel
Viewed 2840 times since Fri, Sep 28, 2018
LVM: Reduce an existing Logical Volume / Filesystem
Viewed 3698 times since Sat, Jun 2, 2018
Netcat shell zabezpieczony hasłem
Viewed 2365 times since Thu, May 24, 2018
How to find the largest files and directories in Linux?
Viewed 3549 times since Sun, May 20, 2018
How to disable SSH cipher/ MAC algorithms for Linux and Unix
Viewed 47604 times since Fri, Aug 21, 2020
3 Ways to Check Linux Kernel Version in Command Line
Viewed 11780 times since Fri, Apr 19, 2019
Open SSL Creating Certificate Signing Request — CSR Generation
Viewed 2022 times since Mon, Feb 18, 2019
How To Set Up an SSL Tunnel Using Stunnel on Ubuntu
Viewed 3447 times since Fri, Sep 28, 2018
ZPOOL: Detach a submirror from a mirrored zpool
Viewed 2848 times since Sun, Jun 3, 2018
Moving SSL Certificate from IIS to Apache
Viewed 2133 times since Mon, Feb 18, 2019