# Auditbeat lost events

**URL:** <https://discuss.elastic.co/t/auditbeat-lost-events/339935>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [August 2, 2023, 11:32am UTC](https://discuss.elastic.co/t/auditbeat-lost-events/339935 "2023-08-02T11:32:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![KevinShi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kevinshi/32/118557_2.png) [@KevinShi](https://discuss.elastic.co/u/KevinShi)\
**Post date:** [August 2, 2023, 11:32am UTC](https://discuss.elastic.co/t/auditbeat-lost-events/339935/1 "2023-08-02T11:32:27Z")

</div>

My auditbeat drop all events when it start a minutes. And auditbeat status info:

```auto
Aug 02 19:11:51 auditbeat[29357]: 2023-08-02T19:11:51.440+0800 INFO [auditd] auditd/audit_linux.go:286 audit status from kernel at start {"audit_status": {"Mask":0,"Enabled":1,"Failure":0,"PID":0,"RateLimit":5000,"BacklogLimit":8192,"Lost":2139,"Backlog":0,"FeatureBitmap":61,"BacklogWaitTime":0}}
Aug 02 19:11:51 auditbeat[29357]: 2023-08-02T19:11:51.440+0800 WARN [auditd] auditd/audit_linux.go:316 setting backlog wait time is not supported in this kernel. Enabling workaround.

```

My test 7.9.3 7.13.4 7.16.3,but problem still exist!  
And configure add queue.spool, problem still.

```auto
queue.spool:
  file:
    path: "${path.data}/spool.dat"
    size: 512MiB
    page_size: 16KiB
  write:
    buffer_size: 10MiB
    flush.timeout: 5s
    flush.events: 1024

```

Help me, Thanks!

---

<div class="post-metadata">

**Author:** ![KevinShi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kevinshi/32/118557_2.png) [@KevinShi](https://discuss.elastic.co/u/KevinShi)\
**Post date:** [August 2, 2023, 11:34am UTC](https://discuss.elastic.co/t/auditbeat-lost-events/339935/2 "2023-08-02T11:34:50Z")

</div>

My kernel is 3.10

```auto
uname -r
3.10.0-1127.19.1.el7.x86_64

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 30, 2023, 1:35pm UTC](https://discuss.elastic.co/t/auditbeat-lost-events/339935/3 "2023-08-30T13:35:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.