What's the meaning of "audit: backlog limit exceeded"
I have a Ubuntu Server machine running Docker containers. I have some hard drives mounted for the Docker machines to use (mainly media storage)
I installed Ubuntu Server with all defaults settings.
I have on the screen many logs appearing:
[59.959145] audit: backlog limit exceeded
The lines are appearing randomly, and I have no idea what it means...
I believe this occurs when kernel kauditd thread is not being able to service the audit records fast enough and a backlog occurs. The default audit backlog is 64 audit buffers, so it may help if these are increased. This can be set to be larger using the kernel parameter "audit_backlog_limit".
For example, edit /etc/default/grub
and add audit_backlog_limit=256
to the GRUB_CMDLINE_LINUX
setting and run sudo update-grub
to set this to 256 buffers.