System crashed with the message "Kernel panic - not syncing: audit: backlog limit exceeded"

Solution Verified - Updated -

Issue

  • System crashed with the following call trace
Backtrace
     KERNEL: vmlinux
   DUMPFILE: vmcore  [PARTIAL DUMP]
       CPUS: 1
       DATE: Mon Apr  9 12:58:07 2012
     UPTIME: 1 days, 08:31:04
LOAD AVERAGE: 1.55, 1.63, 0.92
      TASKS: 218
   NODENAME: xxxxxxxxxx
    RELEASE: 2.6.18-238.1.1.el5
    VERSION: #1 SMP Tue Jan 4 13:34:58 EST 2011
    MACHINE: i686  (2800 Mhz)
     MEMORY: 4 GB
      PANIC: "Kernel panic - not syncing: audit: backlog limit exceeded"
PID: 17302  TASK: ed52aaa0  CPU: 0   COMMAND: "find"
#0 [f0732e60] crash_kexec at c04453eb
#1 [f0732ea4] panic at c0425473
#2 [f0732ec0] audit_panic at c04474cb
#3 [f0732ed0] audit_log_start at c0447c77
#4 [f0732f18] audit_log_exit at c044c7f1
#5 [f0732fb8] system_call at c040502d
   EAX: fffffffe  EBX: bfe97e0e  ECX: 09f30680  EDX: bfe98660 
   DS:  007b      ESI: bfe99d22  ES:  007b      EDI: 00264ff4
   SS:  007b      ESP: bfe97ce0  EBP: bfe97e68
   CS:  0073      EIP: 00499402  ERR: 0000000b  EFLAGS: 00200212 

audit: audit_backlog=16385 > audit_backlog_limit=16384
audit: audit_lost=1 audit_rate_limit=0 audit_backlog_limit=16384
Kernel panic - not syncing: audit: backlog limit exceeded

Environment

  • Red Hat Enterprise Linux

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content