报告消息 "audit: backlog limit exceeded" ,由于文件系统冻结系统可能会挂起
Issue
- 此消息在控制台上持续显示。我必须按电源重启。
audit: backlog limit exceeded
- 在系统日志中看到以下消息:
audit: audit_backlog=321 > audit_backlog_limit=320
audit: audit_lost=44393 audit_rate_limit=0 audit_backlog_limit=320
audit: backlog limit exceeded
audit: audit_backlog=321 > audit_backlog_limit=320
audit: audit_lost=44394 audit_rate_limit=0 audit_backlog_limit=320
audit: backlog limit exceeded
audit: audit_backlog=321 > audit_backlog_limit=320
audit: audit_lost=44395 audit_rate_limit=0 audit_backlog_limit=320
audit: backlog limit exceeded
audit: audit_backlog=321 > audit_backlog_limit=320
Environment
- Red Hat Enterprise Linux 6 , 7 , 8 , 9
- auditd
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.