Auditd fails to start with "Error setting audit daemon pid (No buffer space available)"

Solution Verified - Updated -

Issue

  • Auditd fails to start with the following log messages:
Feb 25 00:00:27 example.com systemd[1]: Starting Security Auditing Service...
Feb 25 00:00:27 example.com auditd[10338]: No plugins found, not dispatching events
Feb 25 00:00:27 example.com auditd[10338]: Error receiving audit netlink packet (No buffer space available)
Feb 25 00:00:27 example.com auditd[10338]: Error setting audit daemon pid (No buffer space available)
Feb 25 00:00:27 example.com auditd[10338]: Unable to set audit pid, exiting
Feb 25 00:00:27 example.com auditd[10337]: Cannot daemonize (Success)
Feb 25 00:00:27 example.com auditd[10337]: The audit daemon is exiting.
Feb 25 00:00:27 example.com systemd[1]: auditd.service: Control process exited, code=exited, status=1/FAILURE
Feb 25 00:00:27 example.com auditd[10338]: The audit daemon is exiting.
Feb 25 00:00:27 example.com systemd[1]: auditd.service: Failed with result 'exit-code'.
Feb 25 00:00:27 example.com systemd[1]: Failed to start Security Auditing Service.
Feb 25 00:00:27 example.com systemd[1]: auditd.service: Scheduled restart job, restart counter is at 1.
Feb 25 00:00:27 example.com systemd[1]: Stopped Security Auditing Service.
Feb 25 00:00:27 example.com systemd[1]: auditd.service: Start request repeated too quickly.
Feb 25 00:00:27 example.com systemd[1]: auditd.service: Failed with result 'exit-code'.
Feb 25 00:00:27 example.com systemd[1]: Failed to start Security Auditing Service.

Environment

  • Red Hat Enterprise Linux 9
  • audit

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content