Why is audispd dropping events? What is in the queue?Why is my mail stuck in the queue with the status “retry” in Exchange 2003?How do I permanently delete e-mail messages in the sendmail queue and keep them from coming back?Exim queue in WHMRunning task queue on server?Is it possible to maintain the queue while restarting HAProxyWill Ubuntu automatically queue hundreds of processes?suppress audit events from a specific userHow to prevent logging USER_AUTH and USER_LOGIN events with auditdWhy does auditd only log `echo` when I use the absolute path?How to configure auditd to record all the activity from events which run with WinSCP

Explicit direct #include vs. Non-contractual transitive #include

Why do you need to heat the pan before heating the olive oil?

How can Caller ID be faked?

How useful is the GRE Exam?

What is this plant I saw for sale at a Romanian farmer's market?

What kind of chart is this?

How can the US president give an order to a civilian?

How can this shape perfectly cover a cube?

Have Steve Rogers (Captain America) and a young Erik Lehnsherr (Magneto) interacted during WWII?

Why is gun control associated with the socially liberal Democratic party?

I have found ports on my Samsung smart tv running a display service. What can I do with it?

In windows systems, is renaming files functionally similar to deleting them?

What are the mechanical differences between Adapt and Monstrosity?

How could I create a situation in which a PC has to make a saving throw or be forced to pet a dog?

How can I detect if I'm in a subshell?

Time at 1G acceleration to travel 100000 light years

Co-worker is now managing my team. Does this mean that I'm being demoted?

How to know whether to write accidentals as sharps or flats?

Digital signature that is only verifiable by one specific person

What is the context for Napoleon's quote "[the Austrians] did not know the value of five minutes"?

Print the phrase "And she said, 'But that's his.'" using only the alphabet

Is the infant mortality rate among African-American babies in Youngstown, Ohio greater than that of babies in Iran?

Do my partner and son need an SSN to be dependents on my taxes?

How do I run a script as sudo at boot time on Ubuntu 18.04 Server?



Why is audispd dropping events? What is in the queue?


Why is my mail stuck in the queue with the status “retry” in Exchange 2003?How do I permanently delete e-mail messages in the sendmail queue and keep them from coming back?Exim queue in WHMRunning task queue on server?Is it possible to maintain the queue while restarting HAProxyWill Ubuntu automatically queue hundreds of processes?suppress audit events from a specific userHow to prevent logging USER_AUTH and USER_LOGIN events with auditdWhy does auditd only log `echo` when I use the absolute path?How to configure auditd to record all the activity from events which run with WinSCP






.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;








2















My audispd keeps logging lots of queue full errors.



 Jun 9 08:46:29 web audispd: queue is full - dropping event


I'd like to understand better why the queue is filling up and whether there is a better way to resolve the problem than continually increasing the q_depth (currently up to 300). My thoughts are that I shouldn't be seeing so many messages that the queue can't be processed. So, how do I find out what is in the queue and why it isn't being flushed out?
(There shouldn't be many events, it's a very quiet web server)










share|improve this question




























    2















    My audispd keeps logging lots of queue full errors.



     Jun 9 08:46:29 web audispd: queue is full - dropping event


    I'd like to understand better why the queue is filling up and whether there is a better way to resolve the problem than continually increasing the q_depth (currently up to 300). My thoughts are that I shouldn't be seeing so many messages that the queue can't be processed. So, how do I find out what is in the queue and why it isn't being flushed out?
    (There shouldn't be many events, it's a very quiet web server)










    share|improve this question
























      2












      2








      2








      My audispd keeps logging lots of queue full errors.



       Jun 9 08:46:29 web audispd: queue is full - dropping event


      I'd like to understand better why the queue is filling up and whether there is a better way to resolve the problem than continually increasing the q_depth (currently up to 300). My thoughts are that I shouldn't be seeing so many messages that the queue can't be processed. So, how do I find out what is in the queue and why it isn't being flushed out?
      (There shouldn't be many events, it's a very quiet web server)










      share|improve this question














      My audispd keeps logging lots of queue full errors.



       Jun 9 08:46:29 web audispd: queue is full - dropping event


      I'd like to understand better why the queue is filling up and whether there is a better way to resolve the problem than continually increasing the q_depth (currently up to 300). My thoughts are that I shouldn't be seeing so many messages that the queue can't be processed. So, how do I find out what is in the queue and why it isn't being flushed out?
      (There shouldn't be many events, it's a very quiet web server)







      queue auditd






      share|improve this question













      share|improve this question











      share|improve this question




      share|improve this question










      asked Jun 9 '15 at 9:53









      user126785user126785

      61117




      61117




















          1 Answer
          1






          active

          oldest

          votes


















          0














          See this thread, which includes a response from the auditd maintainer. It's not super informative, but it gives some good hints.



          I did as suggested, and set priority_boost = 8, which seems to have fixed the issues for me.



          The manpages for audispd.conf and audisp-remote.conf seem to suggest that queue_depth is the more correct parameter to adjust. However, you noted that this wasn't working for you.



          I don't understand well what priority_boost does, but I assume it prevents audit events from being queued to begin with, or at least from spending so much time in the queue. So there's less chance of the queue becoming full.



          There doesn't appear to be much guidance on how to set these parameters, it's just a matter of tuning them until they work.






          share|improve this answer

























            Your Answer








            StackExchange.ready(function()
            var channelOptions =
            tags: "".split(" "),
            id: "2"
            ;
            initTagRenderer("".split(" "), "".split(" "), channelOptions);

            StackExchange.using("externalEditor", function()
            // Have to fire editor after snippets, if snippets enabled
            if (StackExchange.settings.snippets.snippetsEnabled)
            StackExchange.using("snippets", function()
            createEditor();
            );

            else
            createEditor();

            );

            function createEditor()
            StackExchange.prepareEditor(
            heartbeatType: 'answer',
            autoActivateHeartbeat: false,
            convertImagesToLinks: true,
            noModals: true,
            showLowRepImageUploadWarning: true,
            reputationToPostImages: 10,
            bindNavPrevention: true,
            postfix: "",
            imageUploader:
            brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
            contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
            allowUrls: true
            ,
            onDemand: true,
            discardSelector: ".discard-answer"
            ,immediatelyShowMarkdownHelp:true
            );



            );













            draft saved

            draft discarded


















            StackExchange.ready(
            function ()
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f697587%2fwhy-is-audispd-dropping-events-what-is-in-the-queue%23new-answer', 'question_page');

            );

            Post as a guest















            Required, but never shown

























            1 Answer
            1






            active

            oldest

            votes








            1 Answer
            1






            active

            oldest

            votes









            active

            oldest

            votes






            active

            oldest

            votes









            0














            See this thread, which includes a response from the auditd maintainer. It's not super informative, but it gives some good hints.



            I did as suggested, and set priority_boost = 8, which seems to have fixed the issues for me.



            The manpages for audispd.conf and audisp-remote.conf seem to suggest that queue_depth is the more correct parameter to adjust. However, you noted that this wasn't working for you.



            I don't understand well what priority_boost does, but I assume it prevents audit events from being queued to begin with, or at least from spending so much time in the queue. So there's less chance of the queue becoming full.



            There doesn't appear to be much guidance on how to set these parameters, it's just a matter of tuning them until they work.






            share|improve this answer





























              0














              See this thread, which includes a response from the auditd maintainer. It's not super informative, but it gives some good hints.



              I did as suggested, and set priority_boost = 8, which seems to have fixed the issues for me.



              The manpages for audispd.conf and audisp-remote.conf seem to suggest that queue_depth is the more correct parameter to adjust. However, you noted that this wasn't working for you.



              I don't understand well what priority_boost does, but I assume it prevents audit events from being queued to begin with, or at least from spending so much time in the queue. So there's less chance of the queue becoming full.



              There doesn't appear to be much guidance on how to set these parameters, it's just a matter of tuning them until they work.






              share|improve this answer



























                0












                0








                0







                See this thread, which includes a response from the auditd maintainer. It's not super informative, but it gives some good hints.



                I did as suggested, and set priority_boost = 8, which seems to have fixed the issues for me.



                The manpages for audispd.conf and audisp-remote.conf seem to suggest that queue_depth is the more correct parameter to adjust. However, you noted that this wasn't working for you.



                I don't understand well what priority_boost does, but I assume it prevents audit events from being queued to begin with, or at least from spending so much time in the queue. So there's less chance of the queue becoming full.



                There doesn't appear to be much guidance on how to set these parameters, it's just a matter of tuning them until they work.






                share|improve this answer















                See this thread, which includes a response from the auditd maintainer. It's not super informative, but it gives some good hints.



                I did as suggested, and set priority_boost = 8, which seems to have fixed the issues for me.



                The manpages for audispd.conf and audisp-remote.conf seem to suggest that queue_depth is the more correct parameter to adjust. However, you noted that this wasn't working for you.



                I don't understand well what priority_boost does, but I assume it prevents audit events from being queued to begin with, or at least from spending so much time in the queue. So there's less chance of the queue becoming full.



                There doesn't appear to be much guidance on how to set these parameters, it's just a matter of tuning them until they work.







                share|improve this answer














                share|improve this answer



                share|improve this answer








                edited Nov 16 '17 at 17:50

























                answered Nov 16 '17 at 17:16









                orodbhenorodbhen

                1116




                1116



























                    draft saved

                    draft discarded
















































                    Thanks for contributing an answer to Server Fault!


                    • Please be sure to answer the question. Provide details and share your research!

                    But avoid


                    • Asking for help, clarification, or responding to other answers.

                    • Making statements based on opinion; back them up with references or personal experience.

                    To learn more, see our tips on writing great answers.




                    draft saved


                    draft discarded














                    StackExchange.ready(
                    function ()
                    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f697587%2fwhy-is-audispd-dropping-events-what-is-in-the-queue%23new-answer', 'question_page');

                    );

                    Post as a guest















                    Required, but never shown





















































                    Required, but never shown














                    Required, but never shown












                    Required, but never shown







                    Required, but never shown

































                    Required, but never shown














                    Required, but never shown












                    Required, but never shown







                    Required, but never shown







                    Popular posts from this blog

                    Wikipedia:Vital articles Мазмуну Biography - Өмүр баян Philosophy and psychology - Философия жана психология Religion - Дин Social sciences - Коомдук илимдер Language and literature - Тил жана адабият Science - Илим Technology - Технология Arts and recreation - Искусство жана эс алуу History and geography - Тарых жана география Навигация менюсу

                    Club Baloncesto Breogán Índice Historia | Pavillón | Nome | O Breogán na cultura popular | Xogadores | Adestradores | Presidentes | Palmarés | Historial | Líderes | Notas | Véxase tamén | Menú de navegacióncbbreogan.galCadroGuía oficial da ACB 2009-10, páxina 201Guía oficial ACB 1992, páxina 183. Editorial DB.É de 6.500 espectadores sentados axeitándose á última normativa"Estudiantes Junior, entre as mellores canteiras"o orixinalHemeroteca El Mundo Deportivo, 16 setembro de 1970, páxina 12Historia do BreogánAlfredo Pérez, o último canoneiroHistoria C.B. BreogánHemeroteca de El Mundo DeportivoJimmy Wright, norteamericano do Breogán deixará Lugo por ameazas de morteResultados de Breogán en 1986-87Resultados de Breogán en 1990-91Ficha de Velimir Perasović en acb.comResultados de Breogán en 1994-95Breogán arrasa al Barça. "El Mundo Deportivo", 27 de setembro de 1999, páxina 58CB Breogán - FC BarcelonaA FEB invita a participar nunha nova Liga EuropeaCharlie Bell na prensa estatalMáximos anotadores 2005Tempada 2005-06 : Tódolos Xogadores da Xornada""Non quero pensar nunha man negra, mais pregúntome que está a pasar""o orixinalRaúl López, orgulloso dos xogadores, presume da boa saúde económica do BreogánJulio González confirma que cesa como presidente del BreogánHomenaxe a Lisardo GómezA tempada do rexurdimento celesteEntrevista a Lisardo GómezEl COB dinamita el Pazo para forzar el quinto (69-73)Cafés Candelas, patrocinador del CB Breogán"Suso Lázare, novo presidente do Breogán"o orixinalCafés Candelas Breogán firma el mayor triunfo de la historiaEl Breogán realizará 17 homenajes por su cincuenta aniversario"O Breogán honra ao seu fundador e primeiro presidente"o orixinalMiguel Giao recibiu a homenaxe do PazoHomenaxe aos primeiros gladiadores celestesO home que nos amosa como ver o Breo co corazónTita Franco será homenaxeada polos #50anosdeBreoJulio Vila recibirá unha homenaxe in memoriam polos #50anosdeBreo"O Breogán homenaxeará aos seus aboados máis veteráns"Pechada ovación a «Capi» Sanmartín e Ricardo «Corazón de González»Homenaxe por décadas de informaciónPaco García volve ao Pazo con motivo do 50 aniversario"Resultados y clasificaciones""O Cafés Candelas Breogán, campión da Copa Princesa""O Cafés Candelas Breogán, equipo ACB"C.B. Breogán"Proxecto social"o orixinal"Centros asociados"o orixinalFicha en imdb.comMario Camus trata la recuperación del amor en 'La vieja música', su última película"Páxina web oficial""Club Baloncesto Breogán""C. B. Breogán S.A.D."eehttp://www.fegaba.com

                    What should I write in an apology letter, since I have decided not to join a company after accepting an offer letterShould I keep looking after accepting a job offer?What should I do when I've been verbally told I would get an offer letter, but still haven't gotten one after 4 weeks?Do I accept an offer from a company that I am not likely to join?New job hasn't confirmed starting date and I want to give current employer as much notice as possibleHow should I address my manager in my resignation letter?HR delayed background verification, now jobless as resignedNo email communication after accepting a formal written offer. How should I phrase the call?What should I do if after receiving a verbal offer letter I am informed that my written job offer is put on hold due to some internal issues?Should I inform the current employer that I am about to resign within 1-2 weeks since I have signed the offer letter and waiting for visa?What company will do, if I send their offer letter to another company