I have configured 3 servers to send their audit events to my centralized host. I am using port 60 and private network addresses that are supported between the hosts. My iptables/nftables rules

allow all traffic from the specific IP addresses set for my hosts., so there is no problem

with network communication - except for this error I get in my log file for one of the hosts.

I attached to process with strace and when I do so, the error does not appear. When I detach strace, the error appears again. I have verified that log events from the host are making it to the central server.

I have increased q_depth in /etc/audisp/audispd.conf from 250 to 2500 to 25000 to no avail. Upon reading the man page it appears that this is for the "mode forwarding" configuration instead of the "immediate" configuration, which is the default (on debian buster)

Changing the auditd to forward doesn't seem to help. It can't be that the "pipe is full" because there really aren't that many messages - it must be another sort of error.

Thanks in advance for any help.