Why does auditd not resume logging after space is made available in /var/log?

Solution Unverified - Updated -


  • auditd will stop writing to /var/log/audit/audit.log if there is not sufficient space available
  • From experience, we know this works
  • Unfortunately, it will not resume writing to /var/log/audit/audit.log when enough space has become available
  • It will continue logging only after a restart of the auditd service
  • How do we make auditd resume on its own?


  • Red Hat Enterprise Linux (RHEL) 6
  • auditd

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content