auditd[ ]: dispatch err (pipe full) event lost
Issue
- Why does the
/var/log/messagesfile show the following error message?
Jul 15 03:28:04 hostname auditd[2117]: dispatch err (pipe full) event lost
Jul 15 03:28:04 hostname auditd[2117]: dispatch error reporting limit reached - ending report notification.
Environment
- Red Hat Enterprise Linux
- auditd
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.
