# Auditbeat auditd disk space action?
**URL:** https://discuss.elastic.co/t/auditbeat-auditd-disk-space-action/134695
**Category:** Beats
**Tags:** auditbeat
**Created:** [June 5, 2018, 9:48pm UTC](https://discuss.elastic.co/t/auditbeat-auditd-disk-space-action/134695 "2018-06-05T21:48:53Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@ryannelle](https://discuss.elastic.co/u/ryannelle)
#### Post date: [June 5, 2018, 9:48pm UTC](https://discuss.elastic.co/t/auditbeat-auditd-disk-space-action/134695/1 "2018-06-05T21:48:53Z")
Curious, does the Auditbeat auditd module have a space\_left, admin\_space\_left or disk\_full action like auditd does?
If my disk starts filling up I need syslog to start logging that I am running out of space, and if the disk fills up I need to system to halt.
Auditd currently does this but does Auditbeat? I see it has a failure\_mode for kernel running out of memory.
Thanks,
---
### Author:  [@exekias](https://discuss.elastic.co/u/exekias)
#### Post date: [June 6, 2018, 9:53pm UTC](https://discuss.elastic.co/t/auditbeat-auditd-disk-space-action/134695/2 "2018-06-06T21:53:39Z")
Hi @ryannelle,
Auditbeat uses an internal in memory queue for audit events, see [https://www.elastic.co/guide/en/beats/auditbeat/current/configuring-internal-queue.html](https://www.elastic.co/guide/en/beats/auditbeat/current/configuring-internal-queue.html). You can fine tune several parameters, but in general events don't touch the disk.
6.3 will include spooling to disk, so items in the queue can be offloaded to disk, max size will be configurable: [https://www.elastic.co/blog/brewing-in-beats-spooling-to-disk-in-Beats](https://www.elastic.co/blog/brewing-in-beats-spooling-to-disk-in-Beats)
Best regards
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 4, 2022, 5:25am UTC](https://discuss.elastic.co/t/auditbeat-auditd-disk-space-action/134695/3 "2022-11-04T05:25:06Z")