NautheraAuditEventsDropped

Docs version v1 (main) · Nauthera is pre-1.0, in a design-partner program

Non-mandatory audit events were lost because their queue was full.

#Meaning

nauthera_audit_events_dropped_total{lane="buffered"} increased in the last five minutes. Every event that is not mandatory is written in batches from a queue of audit.buffer_size (8192); when audit writes fail or slow down, or the event rate outgrows the writer (a high audit.level such as trace under heavy traffic), the queue fills and further events are dropped.

#Impact

The audit log is missing lower-severity records for the window: reads and routine protocol traffic at the configured level. Auditors and SIEM detections that count those events see less than happened. Users and relying parties are not affected.

#Diagnosis

1. How many: increase(nauthera_audit_events_dropped_total\{job="<name>", lane="buffered"\}[1h]).
2. Is writing failing or slow? rate(nauthera_audit_flushes_total\{job="<name>", result="error"\}[5m]) and the flush latency in nauthera_audit_flush_duration_seconds.
3. Event volume by category: sum by (category) (rate(nauthera_audit_events_total\{job="<name>"\}[5m])).
4. The dropped events are in the application log: kubectl -n <ns> logs <pod> | jq 'select(.msg=="audit event dropped; queue full")'.

#Mitigation

• Failing or slow writes: follow NautheraAuditWritesFailing.
• Volume: lower config.audit.level, or add high-volume actions you do not need to config.audit.exclude; or raise config.audit.buffer_size.

#Escalation

No page. Tell the security or compliance owner if the gap matters to them. Open an issue if drops happen with healthy, fast writes at a modest event rate, with the event-rate, flush and drop graphs and the audit.* settings.

Alert runbooks · Generated from internal/runbook/alerts.yaml and operator/internal/runbook/alerts.yaml in nauthera-server.