# NautheraAuditEventsDropped

Non-mandatory audit events were lost because their queue was full.

## Meaning

`nauthera_audit_events_dropped_total{lane="buffered"}` increased in the last five
minutes. Every event that is not mandatory is written in batches from a queue of
`audit.buffer_size` (8192); when audit writes fail or slow down, or the event rate
outgrows the writer (a high `audit.level` such as `trace` under heavy traffic), the queue
fills and further events are dropped.

## Impact

The audit log is missing lower-severity records for the window: reads and routine
protocol traffic at the configured level. Auditors and SIEM detections that count those
events see less than happened. Users and relying parties are not affected.

## Diagnosis

1. How many: `increase(nauthera_audit_events_dropped_total\{job="<name>",
   lane="buffered"\}[1h])`.
2. Is writing failing or slow? `rate(nauthera_audit_flushes_total\{job="<name>",
   result="error"\}[5m])` and the flush latency in
   `nauthera_audit_flush_duration_seconds`.
3. Event volume by category: `sum by (category)
   (rate(nauthera_audit_events_total\{job="<name>"\}[5m]))`.
4. The dropped events are in the application log:
   `kubectl -n <ns> logs <pod> | jq 'select(.msg=="audit event dropped; queue full")'`.

## Mitigation

- Failing or slow writes: follow NautheraAuditWritesFailing.
- Volume: lower `config.audit.level`, or add high-volume actions you do not need to
  `config.audit.exclude`; or raise `config.audit.buffer_size`.

## Escalation

No page. Tell the security or compliance owner if the gap matters to them. Open an issue
if drops happen with healthy, fast writes at a modest event rate, with the event-rate,
flush and drop graphs and the `audit.*` settings.

---

[Alert runbooks](https://www.nauthera.io/docs/v1/runbooks/alerts) · Generated from [`internal/runbook/alerts.yaml`](https://github.com/nauthera/nauthera-server/blob/main/internal/runbook/alerts.yaml) and [`operator/internal/runbook/alerts.yaml`](https://github.com/nauthera/nauthera-server/blob/main/operator/internal/runbook/alerts.yaml) in nauthera-server.