Using audisp remote results in "dispatch err (pipe full) event lost"

[Steve Grubb]

On Saturday, November 17, 2018 5:50:20 PM EST Kay Mccormick wrote:
> I have configured 3 servers to send their audit events to my centralized
> host. I am using port 60 and private network addresses that are supported
> between the hosts. My iptables/nftables rules
> allow all traffic from the specific IP addresses set for my hosts., so
> there is no problem
> with network communication - except for this error I get in my log file for
> one of the hosts.
> 
> I attached to process with strace and when I do so, the error does not
> appear. When I detach strace, the error appears again. I have verified that
> log events from the host are making it to the central server.
> 
> I have increased q_depth in /etc/audisp/audispd.conf from 250 to 2500 to
> 25000 to no avail. Upon reading the man page it appears that this is for
> the "mode forwarding" configuration instead of the "immediate"
> configuration, which is the default (on debian buster)

Is audispd-remote the only plugin running off audispd? A slow plugin back up 
everything. You might try disabling other plugins that are active to see if 
this helps things. Ultimately, the problem is events are arriving faster than 
they can be sent to plugins. You might also try boosting the priority a 
little assuming all other plugins are tuned off. I think it defaults to 4. 
Also, how big of a storage are you giving audispd-remote? If all other 
plugins are disabled and you still get this, then there might be a need for a 
bigger queue.

-Steve

> Changing the auditd to forward doesn't seem to help. It can't be that the
> "pipe is full" because there really aren't that many messages - it must be
> another sort of error.
> 
> Thanks in advance for any help.