Kernel audit subsystem fails to send data to process with error -111

Solution Unverified - Updated -


  • auditd.service is disabled, but kernel shows the following error message.

    Oct 08 11:21:55 localhost kernel: audit: netlink_unicast sending to audit_pid=28184 returned error: -111


  • Red Hat Enterprise Linux 7
  • osqueryd (3rd party application)

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content