What's the meaning of "audit: backlog limit exceeded"
I have a Ubuntu Server machine running Docker containers. I have some hard drives mounted for the Docker machines to use (mainly media storage)
I installed Ubuntu Server with all defaults settings.
I have on the screen many logs appearing:
[59.959145] audit: backlog limit exceeded
The lines are appearing randomly, and I have no idea what it means...
1 Answer
I believe this occurs when kernel kauditd thread is not being able to service the audit records fast enough and a backlog occurs. The default audit backlog is 64 audit buffers, so it may help if these are increased. This can be set to be larger using the kernel parameter "audit_backlog_limit".
For example, edit /etc/default/grub and add audit_backlog_limit=256 to the GRUB_CMDLINE_LINUX setting and run sudo update-grub to set this to 256 buffers.
More in general
"Zoraya ter Beek, age 29, just died by assisted suicide in the Netherlands. She was physically healthy, but psychologically depressed. It's an abomination that an entire society would actively facilitate, even encourage, someone ending their own life because they had no hope. Th…"
