# NautheraAuditExportFailing

An audit exporter has failed every delivery for ten minutes.

## Meaning

For the exporter named in the `exporter` label, `nauthera_audit_exported_records_total`
counted only `result="error"` batches in the last ten minutes, for fifteen minutes in a
row. The forwarder reads the stored log and hands batches to the exporter; the one built
in, `file`, appends JSON lines to `audit.export.file.path`. Causes are a path that cannot
be written (permissions, a missing volume, a full disk) or an exporter timing out
(`audit.export.timeout`, 10s).

## Impact

The SIEM or log shipper reading the export receives nothing new, so its detections are
blind for the window. No record is lost: records wait in the database and are delivered
from the saved position once the exporter recovers (at least once, so consumers
de-duplicate on `id`). Users and relying parties are not affected.

## Diagnosis

1. Which exporter and replica: `sum by (pod, exporter, result)
   (rate(nauthera_audit_exported_records_total\{job="<name>"\}[10m]))`.
2. The error: `kubectl -n <ns> logs <pod> | jq 'select(.msg=="could not export audit
   records; the batch is offered again")'`. Only the replica holding the exporter's
   lease delivers (`took the audit export lease`).
3. For `file`: whether the volume behind the path is mounted, writable and has space.

## Mitigation

- Restore the destination (mount, permissions, disk space); delivery resumes on its own.
- Rotate the file in place (logrotate's `copytruncate`): the exporter keeps its file open
  and does not rotate it.

## Escalation

Tell the owner of the SIEM or log pipeline so they know detections are behind. If the
destination is healthy and writable but the exporter keeps failing, open an issue with
the export error lines and the `audit.export` settings.

---

[Alert runbooks](https://www.nauthera.io/docs/v1/runbooks/alerts) · Generated from [`internal/runbook/alerts.yaml`](https://github.com/nauthera/nauthera-server/blob/main/internal/runbook/alerts.yaml) and [`operator/internal/runbook/alerts.yaml`](https://github.com/nauthera/nauthera-server/blob/main/operator/internal/runbook/alerts.yaml) in nauthera-server.