Home PageElastic Compute ServiceSupportDisk and memory issuesHow do I modify auditd configurations to prevent automatic instance stops caused by insufficient disk space?
Search for Help Content

How do I modify auditd configurations to prevent automatic instance stops caused by insufficient disk space?

Updated at: 2024-07-02 06:35
Product
Community

Problem description

An Elastic Compute Service (ECS) instance occasionally experiences automatic stops even when no operations are performed. After you restart the instance, the instance runs for a period of time and then automatically stops again. Error messages similar to the following messages appear in the system log files such as /var/log/messages: 
localhost auditd[607]: Audit daemon is low on disk space for logging 
localhost auditd[607]: The audit daemon is now halting the system

Cause

By default, the auditd service is enabled for ECS instances that run CentOS or RHEL operating systems. The auditd service writes a large number of audit log entries to the /var/log/audit/ directory while other services and applications continuously write data to disks. As a result, the disk space may become insufficient. You can configure auditd action parameters, such as space_left_action, admin_space_left_action, and disk_full_action, in the /etc/audit/auditd.conf configuration file to specify what action to take when the disk space is insufficient. If you set an auditd action parameter to halt, the auditd service triggers a system shutdown when the disk space is insufficient. As a result, the ECS instance is stopped.

Solution

  1. Connect to the ECS instance.
    For more information, see Connection method overview.
  2. Run the following command to modify the auditd configuration file: 
    vi /etc/audit/auditd.conf
  3. Change the values of the auditd action parameters that respond to insufficient disk space. The parameters include space_left_action, admin_space_left_action, and disk_full_action.
    We recommend that you set the parameters to SUSPEND, which specifies that the auditd service stops writing audit log entries to the /var/log/audit/ directory when the disk space is insufficient. 
    space_left = 75
space_left_action = SUSPEND
admin_space_left = 50
admin_space_left_action = SUSPEND
disk_full_action = SUSPEND
  4. Restart the auditd service for the new configurations to take effect. 
    systemctl restart auditd.service
Previous: What do I do if I cannot extend a GPT partition on a disk by using the growpart utility after the disk is extended?Next: What do I do if an error occurs when a file system is mounted or when data is read from a file system?
  • On this page （1, T）
  • Problem description
  • Cause
  • Solution
Feedback