NautheraAuditExportFailing

Docs version v1 (main) · Nauthera is pre-1.0, in a design-partner program

An audit exporter has failed every delivery for ten minutes.

#Meaning

For the exporter named in the exporter label, nauthera_audit_exported_records_total counted only result="error" batches in the last ten minutes, for fifteen minutes in a row. The forwarder reads the stored log and hands batches to the exporter; the one built in, file, appends JSON lines to audit.export.file.path. Causes are a path that cannot be written (permissions, a missing volume, a full disk) or an exporter timing out (audit.export.timeout, 10s).

#Impact

The SIEM or log shipper reading the export receives nothing new, so its detections are blind for the window. No record is lost: records wait in the database and are delivered from the saved position once the exporter recovers (at least once, so consumers de-duplicate on id). Users and relying parties are not affected.

#Diagnosis

1. Which exporter and replica: sum by (pod, exporter, result) (rate(nauthera_audit_exported_records_total\{job="<name>"\}[10m])).
2. The error: kubectl -n <ns> logs <pod> | jq 'select(.msg=="could not export audit records; the batch is offered again")'. Only the replica holding the exporter's lease delivers (took the audit export lease).
3. For file: whether the volume behind the path is mounted, writable and has space.

#Mitigation

• Restore the destination (mount, permissions, disk space); delivery resumes on its own.
• Rotate the file in place (logrotate's copytruncate): the exporter keeps its file open and does not rotate it.

#Escalation

Tell the owner of the SIEM or log pipeline so they know detections are behind. If the destination is healthy and writable but the exporter keeps failing, open an issue with the export error lines and the audit.export settings.

Alert runbooks · Generated from internal/runbook/alerts.yaml and operator/internal/runbook/alerts.yaml in nauthera-server.