Using audisp remote results in "dispatch err (pipe full) event lost"

[Kay Mccormick]

I have configured 3 servers to send their audit events to my centralized
host. I am using port 60 and private network addresses that are supported
between the hosts. My iptables/nftables rules
allow all traffic from the specific IP addresses set for my hosts., so
there is no problem
with network communication - except for this error I get in my log file for
one of the hosts.

I attached to process with strace and when I do so, the error does not
appear. When I detach strace, the error appears again. I have verified that
log events from the host are making it to the central server.

I have increased q_depth in /etc/audisp/audispd.conf from 250 to 2500 to
25000 to no avail. Upon reading the man page it appears that this is for
the "mode forwarding" configuration instead of the "immediate"
configuration, which is the default (on debian buster)

Changing the auditd to forward doesn't seem to help. It can't be that the
"pipe is full" because there really aren't that many messages - it must be
another sort of error.

Thanks in advance for any help.

[Steve Grubb]

Post by Kay Mccormick
I have configured 3 servers to send their audit events to my centralized
host. I am using port 60 and private network addresses that are supported
between the hosts. My iptables/nftables rules
allow all traffic from the specific IP addresses set for my hosts., so
there is no problem
with network communication - except for this error I get in my log file for
one of the hosts.
I attached to process with strace and when I do so, the error does not
appear. When I detach strace, the error appears again. I have verified that
log events from the host are making it to the central server.
I have increased q_depth in /etc/audisp/audispd.conf from 250 to 2500 to
25000 to no avail. Upon reading the man page it appears that this is for
the "mode forwarding" configuration instead of the "immediate"
configuration, which is the default (on debian buster)

Is audispd-remote the only plugin running off audispd? A slow plugin back up
everything. You might try disabling other plugins that are active to see if
this helps things. Ultimately, the problem is events are arriving faster than
they can be sent to plugins. You might also try boosting the priority a
little assuming all other plugins are tuned off. I think it defaults to 4.
Also, how big of a storage are you giving audispd-remote? If all other
plugins are disabled and you still get this, then there might be a need for a
bigger queue.

-Steve

Post by Kay Mccormick
Changing the auditd to forward doesn't seem to help. It can't be that the
"pipe is full" because there really aren't that many messages - it must be
another sort of error.
Thanks in advance for any help.