System halted by auditd "The audit daemon is now halting the system"

This document (000020851) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server for SAP 15 SP4
SUSE Linux Enterprise Server for SAP 15 SP3

Situation

The system has been halted by auditd daemon and these messages appear in the logs:
2022-10-05T10:30:59.078194+01:00 SERVER1 auditd[1635]: Audit daemon is low on disk space for logging

2022-10-05T10:32:59.184293+01:00 SERVER1 auditd[1635]: The audit daemon is now halting the system
 

Resolution

Change auditd configuration in /etc/audit/auditd.conf to set the action when the system has detected that it is low on disk space. Open  /etc/audit/auditd.conf and modify the parameter:
admin_space_left_action = halt
Substitute halt with another possible action (ignore, syslog, rotate, email, exec, suspend, single).

For example to change the halt behavior, set the parameter admin_space_left_action in /etc/audit/auditd.conf to another value such as rotate.
admin_space_left_action = rotate
In case there is low space, rotate will rotate logs, losing the oldest to free up space.

After changing the parameters restart auditd with:
systemctl restart auditd

 

Cause

The auditd daemon is configured in /etc/audit/auditd.conf to halt the system when the system has detected that it is low on disk space:
admin_space_left_action = halt

 

Additional Information

auditd.conf - Man Page: https://www.mankier.com/5/auditd.conf

From auditd.conf man page:
admin_space_left_action
This parameter tells the system what action to take when the system has detected that it is low on disk space. Valid values are ignore, syslog, rotate, email, exec, suspend, single, and halt. If set to ignore, the audit daemon does nothing. Syslog means that it will issue a warning to syslog. rotate will rotate logs, losing the oldest to free up space. Email means that it will send a warning to the email account specified in action_mail_acct as well as sending the message to syslog. exec /path-to-script will execute the script. You cannot pass parameters to the script. The script is also responsible for telling the auditd daemon to resume logging once its completed its action. This can be done by adding service auditd resume to the script. Suspend will cause the audit daemon to stop writing records to the disk. The daemon will still be alive. The single option will cause the audit daemon to put the computer system in single user mode. The halt option will cause the audit daemon to shutdown the computer system. Except for rotate, it will perform this action just one time.

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.

  • Document ID:000020851
  • Creation Date: 09-Nov-2022
  • Modified Date:11-Nov-2022
    • SUSE Linux Enterprise Server
    • SUSE Linux Enterprise Server for SAP Applications

< Back to Support Search

For questions or concerns with the SUSE Knowledgebase please contact: tidfeedback[at]suse.com

SUSE Support Forums

Get your questions answered by experienced Sys Ops or interact with other SUSE community experts.

Join Our Community

Support Resources

Learn how to get the most from the technical support you receive with your SUSE Subscription, Premium Support, Academic Program, or Partner Program.


SUSE Customer Support Quick Reference Guide SUSE Technical Support Handbook Update Advisories
Support FAQ

Open an Incident

Open an incident with SUSE Technical Support, manage your subscriptions, download patches, or manage user access.

Go to Customer Center