System halted by auditd "The audit daemon is now halting the system"
This document (000020851) is provided subject to the disclaimer at the end of this document.
Environment
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server for SAP 15 SP4
SUSE Linux Enterprise Server for SAP 15 SP3
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server for SAP 15 SP4
SUSE Linux Enterprise Server for SAP 15 SP3
Situation
The system has been halted by auditd daemon and these messages appear in the logs:
2022-10-05T10:30:59.078194+01:00 SERVER1 auditd[1635]: Audit daemon is low on disk space for logging 2022-10-05T10:32:59.184293+01:00 SERVER1 auditd[1635]: The audit daemon is now halting the system
Resolution
Change auditd configuration in /etc/audit/auditd.conf to set the action when the system has detected that it is low on disk space. Open /etc/audit/auditd.conf and modify the parameter:
Substitute halt with another possible action (ignore, syslog, rotate, email, exec, suspend, single).
For example to change the halt behavior, set the parameter admin_space_left_action in /etc/audit/auditd.conf to
In case there is low space, rotate will rotate logs, losing the oldest to free up space.
After changing the parameters restart auditd with:
admin_space_left_action = halt
Substitute halt with another possible action (ignore, syslog, rotate, email, exec, suspend, single).
For example to change the halt behavior, set the parameter admin_space_left_action in /etc/audit/auditd.conf to
another value such as rotate. admin_space_left_action = rotate
In case there is low space, rotate will rotate logs, losing the oldest to free up space.
After changing the parameters restart auditd with:
systemctl restart auditd
Cause
The auditd daemon is configured in /etc/audit/auditd.conf to halt the system when the system has detected that it is low on disk space:
admin_space_left_action = halt
Additional Information
auditd.conf - Man Page: https://www.mankier.com/5/auditd.conf
From auditd.conf man page:
admin_space_left_action
This parameter tells the system what action to take when the system has detected that it is low on disk space. Valid values are ignore, syslog, rotate, email, exec, suspend, single, and halt. If set to ignore, the audit daemon does nothing. Syslog means that it will issue a warning to syslog. rotate will rotate logs, losing the oldest to free up space. Email means that it will send a warning to the email account specified in action_mail_acct as well as sending the message to syslog. exec /path-to-script will execute the script. You cannot pass parameters to the script. The script is also responsible for telling the auditd daemon to resume logging once its completed its action. This can be done by adding service auditd resume to the script. Suspend will cause the audit daemon to stop writing records to the disk. The daemon will still be alive. The single option will cause the audit daemon to put the computer system in single user mode. The halt option will cause the audit daemon to shutdown the computer system. Except for rotate, it will perform this action just one time.
From auditd.conf man page:
admin_space_left_action
This parameter tells the system what action to take when the system has detected that it is low on disk space. Valid values are ignore, syslog, rotate, email, exec, suspend, single, and halt. If set to ignore, the audit daemon does nothing. Syslog means that it will issue a warning to syslog. rotate will rotate logs, losing the oldest to free up space. Email means that it will send a warning to the email account specified in action_mail_acct as well as sending the message to syslog. exec /path-to-script will execute the script. You cannot pass parameters to the script. The script is also responsible for telling the auditd daemon to resume logging once its completed its action. This can be done by adding service auditd resume to the script. Suspend will cause the audit daemon to stop writing records to the disk. The daemon will still be alive. The single option will cause the audit daemon to put the computer system in single user mode. The halt option will cause the audit daemon to shutdown the computer system. Except for rotate, it will perform this action just one time.
Disclaimer
This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.
- Document ID:000020851
- Creation Date: 09-Nov-2022
- Modified Date:16-Jan-2024
-
- SUSE Linux Enterprise Server
- SUSE Linux Enterprise Server for SAP Applications
For questions or concerns with the SUSE Knowledgebase please contact: tidfeedback[at]suse.com
