<!--startmeta
custom_edit_url: "https://github.com/netdata/netdata/edit/master/src/collectors/debugfs.plugin/integrations/linux_audit_subsystem.md"
meta_yaml: "https://github.com/netdata/netdata/edit/master/src/collectors/debugfs.plugin/metadata.yaml"
sidebar_label: "Linux Audit Subsystem"
learn_status: "Published"
learn_rel_path: "Collecting Metrics/Collectors/Operating Systems"
keywords: ['audit', 'auditd', 'backlog', 'security', 'kernel panic', 'compliance']
message: "DO NOT EDIT THIS FILE DIRECTLY, IT IS GENERATED BY THE COLLECTOR'S metadata.yaml FILE"
endmeta-->

# Linux Audit Subsystem


<img src="https://netdata.cloud/img/linux.svg" width="150"/>


Plugin: debugfs.plugin
Module: audit

<img src="https://img.shields.io/badge/maintained%20by-Netdata-%2300ab44" />

## Overview

Monitors Linux kernel audit subsystem status via NETLINK_AUDIT. Tracks audit backlog depth, backlog utilization, lost events, and configuration (failure mode, enabled state). Critical for detecting audit backlog overflow conditions that cause kernel panics when failure mode is set to 2 (panic).


Query kernel audit status via NETLINK_AUDIT socket (AUDIT_GET)

This collector is only supported on the following platforms:

- Linux

This collector only supports collecting metrics from a single instance of this integration.

This integration requires root privileges or CAP_AUDIT_CONTROL capability to query the kernel audit subsystem via netlink. The Netdata installer grants this capability to debugfs.plugin automatically. The module detects missing privileges and disables itself gracefully.


### Default Behavior

#### Auto-Detection

Automatically detects and monitors the Linux audit subsystem when the kernel supports NETLINK_AUDIT. Gracefully disables itself if audit is not available.


#### Limits

The default configuration for this integration does not impose any limits on data collection.

#### Performance Impact

Minimal. Performs a single netlink query per collection cycle. No file I/O, no process forking.


## Setup


### Prerequisites

#### Linux kernel with audit support

The Linux kernel must have audit support enabled (CONFIG_AUDIT=y). Most distribution kernels include this by default.



### Configuration

#### Options



<details open><summary>Config options</summary>



| Option | Description | Default | Required |
|:-----|:------------|:--------|:---------:|
| update every | Data collection frequency. | 1 | no |


</details>



#### via File

The configuration file name for this integration is `netdata.conf`.
Configuration for this specific integration is located in the `[plugin:debugfs]` section within that file.

The file format is a modified INI syntax. The general structure is:

```ini
[section1]
    option1 = some value
    option2 = some other value

[section2]
    option3 = some third value
```
You can edit the configuration file using the [`edit-config`](https://github.com/netdata/netdata/blob/master/docs/netdata-agent/configuration/README.md#edit-configuration-files) script from the
Netdata [config directory](https://github.com/netdata/netdata/blob/master/docs/netdata-agent/configuration/README.md#locate-your-config-directory).

```bash
cd /etc/netdata 2>/dev/null || cd /opt/netdata/etc/netdata
sudo ./edit-config netdata.conf
```

##### Examples
There are no configuration examples.



## Alerts


The following alerts are available:

| Alert name  | On metric | Description |
|:------------|:----------|:------------|
| [ audit_backlog_utilization ](https://github.com/netdata/netdata/blob/master/src/health/health.d/audit.conf) | audit.backlog_utilization | Linux audit backlog utilization has exceeded the warning threshold while failure mode is set to panic. Kernel panic is imminent if backlog overflows. |
| [ audit_lost_events ](https://github.com/netdata/netdata/blob/master/src/health/health.d/audit.conf) | audit.lost | Linux audit subsystem is losing events (backlog overflow, rate limiting, or memory pressure). |



## Metrics

Metrics grouped by *scope*.

The scope defines the instance that the metric belongs to. An instance is uniquely identified by a set of labels.

Monitor the Linux kernel audit subsystem status and backlog health.


### Per Linux Audit Subsystem instance

Audit subsystem status for the entire system.

This scope has no labels.

Metrics:

| Metric | Description | Dimensions | Unit |
|:------|:------------|:----------|:----|
| audit.backlog | Audit Backlog | used, free | events |
| audit.backlog_utilization | Audit Backlog Utilization | utilization | % |
| audit.lost | Audit Lost Events | lost | events/s |
| audit.enabled | Audit Enabled State | disabled, enabled, immutable | state |
| audit.failure | Audit Failure Mode | silent, printk, panic | state |
