Skip to content

The v1 docs follow nauthera-server's main branch and its 0.x releases on the way to 1.0, so fields and APIs can still change.

v1

NautheraAuditMandatoryEventsDropped

Docs version v1 (main)Nauthera is pre-1.0, in a design-partner program

Mandatory audit events were lost because their queue was full.

Meaning

nauthera_audit_events_dropped_total{lane="priority"} increased in the last five minutes. Mandatory events (sign-in outcomes, credential and role changes, administrator actions, the server's own system records) have a queue of their own, audit.priority_buffer_size (8192). A full queue drops rather than blocks, so this fires when the database has been refusing or stalling writes long enough for the queue to fill, or when a flood of events outran the writer. Unauthenticated callers may fill only half of the queue, so a flood of anonymous refusals alone does not fill it.

Impact

Auditors and the SIEM: the audit log has a gap that looks complete. Records of who signed in, who changed what, or what an administrator did may be missing for the window, which can matter for an investigation or a compliance attestation. Users and relying parties are not affected by the drop itself.

Diagnosis

  1. How many, and on which replicas: increase(nauthera_audit_events_dropped_total\{ job="<name>",lane="priority"\}[1h]).
  2. Why the queue filled: is NautheraAuditWritesFailing or NautheraDatabaseUnavailable firing? Write latency: histogram_quantile(0.99, sum by (le) (rate(nauthera_audit_flush_duration_seconds_bucket\{job="<name>"\}[5m]))).
  3. Queue depth: nauthera_audit_buffer_depth{job="<name>",lane="priority"} against nauthera_audit_buffer_capacity.
  4. The dropped events themselves are in the application log as a degraded copy: kubectl -n <ns> logs <pod> | jq 'select(.msg=="audit event dropped; queue full")'.
  5. The log records the loss once writes resume, as system.audit.overflow with the count (a platform record, visible to holders of platform.audit).

Mitigation

  • Restore audit writes first: follow NautheraAuditWritesFailing or NautheraDatabaseUnavailable.
  • A burst that outran a healthy writer: raise config.audit.priority_buffer_size.
  • Preserve the application log for the window: the degraded copies are the only record of the dropped events, so make sure your log shipping kept them.

Escalation

Tell the security or compliance owner the same day, with the window and the count from system.audit.overflow: the gap may need to be declared. If drops happen while the database is healthy and writes are fast, open an issue with the queue depth, flush latency and drop graphs, and the audit.* settings.

Alert runbooks · Generated from internal/runbook/alerts.yaml and operator/internal/runbook/alerts.yaml in nauthera-server.