Linux Audit (auditd)

auditctl -s

auditctl -l | wc -l

auditctl -l

audisp-af_unix

• It is an audit dispatcher plugin

• It forwards audit events over a UNIX domain socket

• It normally uses tiny amounts of memory (a few MB of RAM and near zero swap)

pidof audisp-af_unix

cat /proc/$(pidof audisp-af_unix)/status | egrep 'VmRSS|VmSwap'

When audisp-af_unix consumes large memory / swap, it almost always indicates:

• Audit socket consumer stopped or is slow

• Audit logs not being drained

• Audit rules generating huge volumes of events

• Disk IO slowdown causing audit backlog

• A misconfigured SIEM / security agent

When the audit queue backs up:

• audisp-af_unix buffers events in memory

• Kernel eventually pushes it to swap

• Swap fills 

To avoid memory/swap issues caused by audit...

• Cap audit backlog size

• Review audit rules for excessive verbosity

• Ensure audit consumers are always running

• Monitor audisp memory separately in Zabbix

• Consider moving heavy audit workloads off DB servers

Bibliography