Using audisp remote results in "dispatch err (pipe full) event lost"

[Kay Mccormick]

I have configured 3 servers to send their audit events to my centralized
host. I am using port 60 and private network addresses that are supported
between the hosts. My iptables/nftables rules
allow all traffic from the specific IP addresses set for my hosts., so
there is no problem
with network communication - except for this error I get in my log file for
one of the hosts.

I attached to process with strace and when I do so, the error does not
appear. When I detach strace, the error appears again. I have verified that
log events from the host are making it to the central server.

I have increased q_depth in /etc/audisp/audispd.conf from 250 to 2500 to
25000 to no avail. Upon reading the man page it appears that this is for
the "mode forwarding" configuration instead of the "immediate"
configuration, which is the default (on debian buster)

Changing the auditd to forward doesn't seem to help. It can't be that the
"pipe is full" because there really aren't that many messages - it must be
another sort of error.

Thanks in advance for any help.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20181117/430598c0/attachment.htm>