| 1 | # Alerts for the Linux audit subsystem. |
| 2 | # Monitors audit backlog utilization relative to failure mode, |
| 3 | # and detects audit event loss. |
| 4 | |
| 5 | # Alert when audit backlog is filling up AND failure mode is panic (2). |
| 6 | # This combination means the system will kernel panic if the backlog overflows. |
| 7 | # Only fires when failure=2 (panic mode) — for other failure modes, |
| 8 | # audit_lost_events covers actual event loss. |
| 9 | |
| 10 | template: audit_backlog_utilization |
| 11 | on: audit.backlog_utilization |
| 12 | class: Utilization |
| 13 | type: System |
| 14 | component: Audit |
| 15 | lookup: max -1m unaligned of utilization |
| 16 | units: % |
| 17 | every: 10s |
| 18 | warn: $this > 50 AND $audit.failure.panic == 1 |
| 19 | crit: $this > 80 AND $audit.failure.panic == 1 |
| 20 | delay: down 5m multiplier 1.5 max 1h |
| 21 | summary: Audit backlog utilization (kernel panic risk) |
| 22 | info: Linux audit backlog is filling up while failure mode is set to panic — kernel panic is imminent if backlog overflows |
| 23 | to: sysadmin |
| 24 | |
| 25 | # Alert when audit events are being lost (dropped). |
| 26 | # This indicates the audit subsystem cannot keep up with event volume. |
| 27 | |
| 28 | template: audit_lost_events |
| 29 | on: audit.lost |
| 30 | class: Errors |
| 31 | type: System |
| 32 | component: Audit |
| 33 | lookup: max -1m unaligned of lost |
| 34 | units: events/s |
| 35 | every: 10s |
| 36 | warn: $this > 0 |
| 37 | delay: down 5m multiplier 1.5 max 1h |
| 38 | summary: Audit subsystem losing events |
| 39 | info: Linux audit subsystem is losing events (backlog overflow, rate limiting, or memory pressure) |
| 40 | to: sysadmin |