Auditd fails to start with "Error setting audit daemon pid (No buffer space available)"
Issue
- Auditd fails to start with the following log messages:
Feb 25 00:00:27 example.com systemd[1]: Starting Security Auditing Service...
Feb 25 00:00:27 example.com auditd[10338]: No plugins found, not dispatching events
Feb 25 00:00:27 example.com auditd[10338]: Error receiving audit netlink packet (No buffer space available)
Feb 25 00:00:27 example.com auditd[10338]: Error setting audit daemon pid (No buffer space available)
Feb 25 00:00:27 example.com auditd[10338]: Unable to set audit pid, exiting
Feb 25 00:00:27 example.com auditd[10337]: Cannot daemonize (Success)
Feb 25 00:00:27 example.com auditd[10337]: The audit daemon is exiting.
Feb 25 00:00:27 example.com systemd[1]: auditd.service: Control process exited, code=exited, status=1/FAILURE
Feb 25 00:00:27 example.com auditd[10338]: The audit daemon is exiting.
Feb 25 00:00:27 example.com systemd[1]: auditd.service: Failed with result 'exit-code'.
Feb 25 00:00:27 example.com systemd[1]: Failed to start Security Auditing Service.
Feb 25 00:00:27 example.com systemd[1]: auditd.service: Scheduled restart job, restart counter is at 1.
Feb 25 00:00:27 example.com systemd[1]: Stopped Security Auditing Service.
Feb 25 00:00:27 example.com systemd[1]: auditd.service: Start request repeated too quickly.
Feb 25 00:00:27 example.com systemd[1]: auditd.service: Failed with result 'exit-code'.
Feb 25 00:00:27 example.com systemd[1]: Failed to start Security Auditing Service.
Environment
- Red Hat Enterprise Linux 9
- audit
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.