Using audisp remote results in "dispatch err (pipe full) event lost"

Using audisp remote results in "dispatch err (pipe full) event lost"

[Kay Mccormick]

[-- Attachment #1.1: Type: text/plain, Size: 1059 bytes --]

I have configured 3 servers to send their audit events to my centralized
host. I am using port 60 and private network addresses that are supported
between the hosts. My iptables/nftables rules
allow all traffic from the specific IP addresses set for my hosts., so
there is no problem
with network communication - except for this error I get in my log file for
one of the hosts.

I attached to process with strace and when I do so, the error does not
appear. When I detach strace, the error appears again. I have verified that
log events from the host are making it to the central server.

I have increased q_depth in /etc/audisp/audispd.conf from 250 to 2500 to
25000 to no avail. Upon reading the man page it appears that this is for
the "mode forwarding" configuration instead of the "immediate"
configuration, which is the default (on debian buster)

Changing the auditd to forward doesn't seem to help. It can't be that the
"pipe is full" because there really aren't that many messages - it must be
another sort of error.

Thanks in advance for any help.

[-- Attachment #1.2: Type: text/html, Size: 1265 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: Using audisp remote results in "dispatch err (pipe full) event lost"

[Steve Grubb]

On Saturday, November 17, 2018 5:50:20 PM EST Kay Mccormick wrote:
> I have configured 3 servers to send their audit events to my centralized
> host. I am using port 60 and private network addresses that are supported
> between the hosts. My iptables/nftables rules
> allow all traffic from the specific IP addresses set for my hosts., so
> there is no problem
> with network communication - except for this error I get in my log file for
> one of the hosts.
> 
> I attached to process with strace and when I do so, the error does not
> appear. When I detach strace, the error appears again. I have verified that
> log events from the host are making it to the central server.
> 
> I have increased q_depth in /etc/audisp/audispd.conf from 250 to 2500 to
> 25000 to no avail. Upon reading the man page it appears that this is for
> the "mode forwarding" configuration instead of the "immediate"
> configuration, which is the default (on debian buster)

Is audispd-remote the only plugin running off audispd? A slow plugin back up 
everything. You might try disabling other plugins that are active to see if 
this helps things. Ultimately, the problem is events are arriving faster than 
they can be sent to plugins. You might also try boosting the priority a 
little assuming all other plugins are tuned off. I think it defaults to 4. 
Also, how big of a storage are you giving audispd-remote? If all other 
plugins are disabled and you still get this, then there might be a need for a 
bigger queue.

-Steve

> Changing the auditd to forward doesn't seem to help. It can't be that the
> "pipe is full" because there really aren't that many messages - it must be
> another sort of error.
> 
> Thanks in advance for any help.