# NautheraAuditMandatoryEventsDropped

Mandatory audit events were lost because their queue was full.

## Meaning

`nauthera_audit_events_dropped_total{lane="priority"}` increased in the last five
minutes. Mandatory events (sign-in outcomes, credential and role changes, administrator
actions, the server's own system records) have a queue of their own,
`audit.priority_buffer_size` (8192). A full queue drops rather than blocks, so this fires
when the database has been refusing or stalling writes long enough for the queue to
fill, or when a flood of events outran the writer. Unauthenticated callers may fill only
half of the queue, so a flood of anonymous refusals alone does not fill it.

## Impact

Auditors and the SIEM: the audit log has a gap that looks complete. Records of who signed
in, who changed what, or what an administrator did may be missing for the window, which
can matter for an investigation or a compliance attestation. Users and relying parties
are not affected by the drop itself.

## Diagnosis

1. How many, and on which replicas: `increase(nauthera_audit_events_dropped_total\{
   job="<name>",lane="priority"\}[1h])`.
2. Why the queue filled: is NautheraAuditWritesFailing or NautheraDatabaseUnavailable
   firing? Write latency: `histogram_quantile(0.99, sum by (le)
   (rate(nauthera_audit_flush_duration_seconds_bucket\{job="<name>"\}[5m])))`.
3. Queue depth: `nauthera_audit_buffer_depth{job="<name>",lane="priority"}` against
   `nauthera_audit_buffer_capacity`.
4. The dropped events themselves are in the application log as a degraded copy:
   `kubectl -n <ns> logs <pod> | jq 'select(.msg=="audit event dropped; queue full")'`.
5. The log records the loss once writes resume, as `system.audit.overflow` with the
   count (a platform record, visible to holders of `platform.audit`).

## Mitigation

- Restore audit writes first: follow NautheraAuditWritesFailing or
  NautheraDatabaseUnavailable.
- A burst that outran a healthy writer: raise `config.audit.priority_buffer_size`.
- Preserve the application log for the window: the degraded copies are the only record of
  the dropped events, so make sure your log shipping kept them.

## Escalation

Tell the security or compliance owner the same day, with the window and the count from
`system.audit.overflow`: the gap may need to be declared. If drops happen while the
database is healthy and writes are fast, open an issue with the queue depth, flush
latency and drop graphs, and the `audit.*` settings.

---

[Alert runbooks](https://www.nauthera.io/docs/v1/runbooks/alerts) · Generated from [`internal/runbook/alerts.yaml`](https://github.com/nauthera/nauthera-server/blob/main/internal/runbook/alerts.yaml) and [`operator/internal/runbook/alerts.yaml`](https://github.com/nauthera/nauthera-server/blob/main/operator/internal/runbook/alerts.yaml) in nauthera-server.