2

I noticed that I no longer get any output from a docker service logs my-service, even though the service itself still seems to be fine, and I can ssh onto the server without any problems. Then I tried to open a console to the server from the server provider (not sure what mechanism it uses), but I only see lots of these messages:

audit: backlog limit exceeded

What is the correct way of dealing with this? I've searched and could only find this which relates to CentOS -- mine is an Ubuntu based server -- and in addition my server isn't locking up as such.

drmrbrewer
  • 71
  • 5
  • There should be additional messages logged of the form `audit: audit_backlog=Y > audit_backlog_limit=X`. Knowing what `X` is set to currently would be helpful. – bodgit Mar 10 '19 at 08:16
  • Where would I find those messages? They don't show in the logs I'm seeing at present. – drmrbrewer Mar 10 '19 at 13:42
  • Based on RHEL/CentOS I would expect it to be logged along with the message you posted. Either `dmesg` should show it, or it's one of the log files under `/var/log`. – bodgit Mar 10 '19 at 14:35

0 Answers0