5

I have a Ubuntu Server machine running Docker containers. I have some hard drives mounted for the Docker machines to use (mainly media storage)

I installed Ubuntu Server with all defaults settings.
I have on the screen many logs appearing:

[59.959145] audit: backlog limit exceeded

The lines are appearing randomly, and I have no idea what it means...  

1 Answer 1

5

I believe this occurs when kernel kauditd thread is not being able to service the audit records fast enough and a backlog occurs. The default audit backlog is 64 audit buffers, so it may help if these are increased. This can be set to be larger using the kernel parameter "audit_backlog_limit".

For example, edit /etc/default/grub and add audit_backlog_limit=256 to the GRUB_CMDLINE_LINUX setting and run sudo update-grub to set this to 256 buffers.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .