Hello All,
We use an auditd plugin to monitor system calls like socket, connect etc. This plugin read
data from audit netlink socket and converts into a internal format.
Recently we are noticing that on some distributions like Oracle 9, Kernel Version:
5.15.0-100.96.32.el9uek.x86_64, our plugin is not coming up.
We see the below log in the output of "systemctl status auditd" command:
Error receiving audit netlink packet (No buffer space available)
I have tried to increase the q_depth, and backlog limit of auditd, but still hitting this
error.
Any suggestions or help?
Regards
Anurag