Skip to content

The v1 docs follow nauthera-server's main branch and its 0.x releases on the way to 1.0, so fields and APIs can still change.

v1

NautheraAuditPartitionsNotMaintained

Docs version v1 (main)Nauthera is pre-1.0, in a design-partner program

Audit log partitions for the coming months are missing.

Meaning

nauthera_audit_partitions_missing{month="upcoming"} has been above 0 for an hour: partitions the maintenance keeps ready ahead of the writes are missing. With audit.partition_maintenance: external the maintenance CronJob (appendOnlyAudit) has not run lately or is failing; with internal, the server's own pass, every audit.maintenance_interval (6h), cannot create them. Nothing fails until a month without a partition begins.

Impact

Nobody is affected yet. If nothing is done before the first missing month starts (UTC), NautheraAuditPartitionMissing follows, with its risk of an outage at the next restart under external maintenance.

Diagnosis

  1. How many: nauthera_audit_partitions_missing{job="<name>"}.
  2. External: kubectl -n <ns> get cronjob <name>-maintain -o wide (is it suspended? when did it last succeed?), kubectl -n <ns> get jobs, and the failing run's log. The server logs audit log partitions for the coming months are missing; ... at each check, with the missing partition names.
  3. Internal: kubectl -n &lt;ns&gt; logs &lt;pod&gt; | jq 'select(.msg|startswith("could not create audit log partitions"))'. The failure is also recorded as a failed system.audit.partition_created.

Mitigation

  • External: run it now, kubectl -n <ns> create job --from=cronjob/<name>-maintain <name>-maintain-manual, and fix whatever stops the scheduled runs (a suspended CronJob, a failing image pull, an expired owner credential, activeDeadlineSeconds too short for an index build).
  • Internal: fix what the log names, usually privileges or a lock timeout; the next pass or a pod restart creates the partitions.

Escalation

No page. Escalate to the identity platform owner if the cause is not fixed within a few days, and well before the month boundary. Open an issue if maintain succeeds but the server still reports partitions missing, with the maintenance log and the partition list.

Alert runbooks · Generated from internal/runbook/alerts.yaml and operator/internal/runbook/alerts.yaml in nauthera-server.