# NautheraAuditQueueBacklog

An audit queue is more than 40% full.

## Meaning

`nauthera_audit_buffer_depth / nauthera_audit_buffer_capacity` for one queue (`lane`:
`priority` for mandatory events, `buffered` for the rest) has been above the threshold
(0.4) for five minutes. Events arrive faster than the writer stores them: writes are
slow or failing, or the event rate jumped (an attack producing many refusals, a raised
`audit.level`). This alert fires before any event is dropped.

## Impact

Nothing is lost yet. Records reach the database and the exporters later, so the SIEM sees
them late. On the priority queue, unauthenticated callers' mandatory events are refused
room once it is half full, and at four fifths the pipeline turns degraded, which with
`audit.fail_closed` refuses administrators' privileged changes.

## Diagnosis

1. Which queue and replica: `nauthera_audit_buffer_depth\{job="<name>"\} /
   nauthera_audit_buffer_capacity\{job="<name>"\}`.
2. Write health: `rate(nauthera_audit_flushes_total{job="<name>",result="error"}[5m])`
   and the p99 of `nauthera_audit_flush_duration_seconds`.
3. Arrival rate by category: `sum by (category, outcome)
   (rate(nauthera_audit_events_total\{job="&lt;name&gt;"\}[5m]))`. A jump in failures points to an
   attack; check NautheraThreatSignalCritical and NautheraSignInFailureSpike.

## Mitigation

- Slow or failing writes: follow NautheraAuditWritesFailing; check database load.
- Higher volume than the queue absorbs: raise `config.audit.buffer_size` or
  `config.audit.priority_buffer_size`, or lower `config.audit.level`.
- An attack: handle it as its own alert says; refusals from the edge are coalesced, so
  the backlog falls once the source is blocked.

## Escalation

No page on its own; escalate to the identity platform owner if the backlog keeps growing
towards drops (NautheraAuditEventsDropped, NautheraAuditMandatoryEventsDropped).

---

[Alert runbooks](https://www.nauthera.io/docs/v1/runbooks/alerts) · Generated from [`internal/runbook/alerts.yaml`](https://github.com/nauthera/nauthera-server/blob/main/internal/runbook/alerts.yaml) and [`operator/internal/runbook/alerts.yaml`](https://github.com/nauthera/nauthera-server/blob/main/operator/internal/runbook/alerts.yaml) in nauthera-server.