Skip to content

The v1 docs follow nauthera-server's main branch and its 0.x releases on the way to 1.0, so fields and APIs can still change.

v1

NautheraAuditQueueBacklog

Docs version v1 (main)Nauthera is pre-1.0, in a design-partner program

An audit queue is more than 40% full.

Meaning

nauthera_audit_buffer_depth / nauthera_audit_buffer_capacity for one queue (lane: priority for mandatory events, buffered for the rest) has been above the threshold (0.4) for five minutes. Events arrive faster than the writer stores them: writes are slow or failing, or the event rate jumped (an attack producing many refusals, a raised audit.level). This alert fires before any event is dropped.

Impact

Nothing is lost yet. Records reach the database and the exporters later, so the SIEM sees them late. On the priority queue, unauthenticated callers' mandatory events are refused room once it is half full, and at four fifths the pipeline turns degraded, which with audit.fail_closed refuses administrators' privileged changes.

Diagnosis

  1. Which queue and replica: nauthera_audit_buffer_depth\{job="<name>"\} / nauthera_audit_buffer_capacity\{job="<name>"\}.
  2. Write health: rate(nauthera_audit_flushes_total{job="<name>",result="error"}[5m]) and the p99 of nauthera_audit_flush_duration_seconds.
  3. Arrival rate by category: sum by (category, outcome) (rate(nauthera_audit_events_total\{job="&lt;name&gt;"\}[5m])). A jump in failures points to an attack; check NautheraThreatSignalCritical and NautheraSignInFailureSpike.

Mitigation

  • Slow or failing writes: follow NautheraAuditWritesFailing; check database load.
  • Higher volume than the queue absorbs: raise config.audit.buffer_size or config.audit.priority_buffer_size, or lower config.audit.level.
  • An attack: handle it as its own alert says; refusals from the edge are coalesced, so the backlog falls once the source is blocked.

Escalation

No page on its own; escalate to the identity platform owner if the backlog keeps growing towards drops (NautheraAuditEventsDropped, NautheraAuditMandatoryEventsDropped).

Alert runbooks · Generated from internal/runbook/alerts.yaml and operator/internal/runbook/alerts.yaml in nauthera-server.