'kernel: audit: backlog limit exceeded' messages in /var/log/messages

Solution Verified - Updated 2024-01-15T15:00:53+00:00 -

Issue

/var/log/messages shows repeated messages indicating the audit_backlog was greater than the allowed limit

kernel: audit: audit_backlog=65537 > audit_backlog_limit=65536
kernel: audit: audit_lost=126533574 audit_rate_limit=0 audit_backlog_limit=65536

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Here are the common uses of Markdown.

Code blocks

~~~
Code surrounded in tildes is easier to read
~~~

Links/URLs

[Red Hat Customer Portal](https://access.redhat.com)