# Rocky 8 - Error receiving audit netlink packet

**URL:** <https://forums.rockylinux.org/t/rocky-8-error-receiving-audit-netlink-packet/20266>\
**Category:** Rocky Linux Help & Support\
**Tags:** rocky-linux-8\
**Created:** [March 9, 2026, 2:44pm UTC](https://forums.rockylinux.org/t/rocky-8-error-receiving-audit-netlink-packet/20266 "2026-03-09T14:44:29Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![DannyIrish](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/dannyirish/32/2466_2.png) [@DannyIrish](https://forums.rockylinux.org/u/DannyIrish)\
**Post date:** [March 9, 2026, 2:44pm UTC](https://forums.rockylinux.org/t/rocky-8-error-receiving-audit-netlink-packet/20266/1 "2026-03-09T14:44:29Z")

</div>

I am starting to see a bunch of log entries complaining about the auditd service:

auditd[#####]: Error receiving audit netlink packet (No buffer space available)

Seems to be related to this:

> **[Red Hat BugID RHEL-102936 - BugZero](https://www.findbugzero.com/operational-defect-database/vendors/rh/defects/RHEL-102936)**
>
> Fix RHEL-102936, auditd complains with "Error receiving audit netlink packet (No buffer space available)" message

and this, but I can not access the “Solution Verified”

> **[auditd reports "Error receiving audit netlink packet (No buffer space...](https://access.redhat.com/solutions/7058400)**
>
> auditd reports Error receiving audit netlink packet (No buffer space available) repeatedly after auditd log rotation or when applying a large yum update Dec 29 11:10:33 myrhel8 auditd\[719779\]: Error receiving audit netlink packet (No buffer space...

Similar to the above, increasing the buffer does not help. Only thing that has been “changed” over the years is normal kernel updates. Feels like something along the way has altered the kernel/audit settings, as this issue is relatively new for me. I’ve tried to patch and reboot the latest Rocky Linux 8 install, but the issue remains. My current audit settings are based of the STIG configuration:

```auto
-a always,exit -F arch=b32 -S stime,settimeofday,adjtimex -F key=time-change
-a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=time-change
-a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -F key=time-change
-a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -F key=time-change
-w /etc/localtime -p wa -k time-change
-w /etc/group -p wa -k identity
-w /etc/passwd -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/security/opasswd -p wa -k identity
-a always,exit -F arch=b32 -S sethostname,setdomainname -F key=system-locale
-a always,exit -F arch=b64 -S sethostname,setdomainname -F key=system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/hostname -p wa -k system-locale
-w /etc/NetworkManager/ -p wa -k system-locale
-w /etc/selinux/ -p wa -k MAC-policy
-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=-1 -F key=perm_mod
-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=-1 -F key=perm_mod
-a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F auid>=1000 -F auid!=-1 -F key=perm_mod
-a always,exit -F arch=b64 -S chown,fchown,lchown,fchownat -F auid>=1000 -F auid!=-1 -F key=perm_mod
-a always,exit -F arch=b32 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid>=1000 -F auid!=-1 -F key=perm_mod
-a always,exit -F arch=b64 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid>=1000 -F auid!=-1 -F key=perm_mod
-a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at,openat2 -F exit=-EACCES -F auid>=1000 -F auid!=-1 -F key=access
-a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at,openat2 -F exit=-EPERM -F auid>=1000 -F auid!=-1 -F key=access
-a always,exit -F arch=b64 -S open,truncate,ftruncate,creat,openat,open_by_handle_at,openat2 -F exit=-EACCES -F auid>=1000 -F auid!=-1 -F key=access
-a always,exit -F arch=b64 -S open,truncate,ftruncate,creat,openat,open_by_handle_at,openat2 -F exit=-EPERM -F auid>=1000 -F auid!=-1 -F key=access
-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=-1 -F key=export
-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=-1 -F key=export
-a always,exit -F arch=b32 -S unlink,rename,unlinkat,renameat -F auid>=1000 -F auid!=-1 -F key=delete
-a always,exit -F arch=b64 -S rename,unlink,unlinkat,renameat -F auid>=1000 -F auid!=-1 -F key=delete
-w /etc/sudoers -p wa -k actions
-w /etc/sudoers.d -p wa -k actions
-a always,exit -S all -F path=/usr/bin/systemd-run -F perm=x -F auid!=-1 -F key=maybe-escalation
-w /usr/bin/pkexec -p x -k maybe-escalation
-a always,exit -F arch=b32 -S init_module,finit_module -F key=module-load
-a always,exit -F arch=b64 -S init_module,finit_module -F key=module-load
-a always,exit -F arch=b32 -S delete_module -F key=module-unload
-a always,exit -F arch=b64 -S delete_module -F key=module-unload

```

Anybody else seeing this ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/rockylinux/original/1X/91b7219eec10e30013422e4df76c1d898711a5d5.svg) [@system](https://forums.rockylinux.org/u/system)\
**Post date:** [May 8, 2026, 2:45pm UTC](https://forums.rockylinux.org/t/rocky-8-error-receiving-audit-netlink-packet/20266/2 "2026-05-08T14:45:14Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.