The audit daemon is now halting the system

Feb 23 08:19:27 ubuntu postfix/cleanup[2718]: 8224460015: message-id=<20230223081927.8224460015@ubuntu>

Feb 23 08:19:27 ubuntu postfix/qmgr[1620]: 8224460015: from=<root@ubuntu>, size=403, nrcpt=1 (queue active)

Feb 23 08:19:27 ubuntu postfix/local[2720]: 8224460015: to=<root@ubuntu>, orig_to=<root>, relay=local, delay=0.12, delays=0.03/0/0/0.09, dsn=2.0.0, status=sent (delivered to mailbox)

Feb 23 08:19:27 ubuntu postfix/qmgr[1620]: 8224460015: removed

Feb 23 08:20:05 ubuntu auditd[652]: The audit daemon is now halting the system

Resolution

Change auditd configuration in /etc/audit/auditd.conf to set the action when the system has detected that it is low on disk space. Open /etc/audit/auditd.conf and modify the parameter:

admin_space_left_action = halt

Substitute halt with another possible action (ignore, syslog, rotate, email, exec, suspend, single).

For example to change the halt behavior, set the parameter admin_space_left_action in /etc/audit/auditd.conf to another value such as rotate.

admin_space_left_action = rotate

In case there is low space, rotate will rotate logs, losing the oldest to free up space.

After changing the parameters restart auditd with:

systemctl restart auditd

Cause

The auditd daemon is configured in /etc/audit/auditd.conf to halt the system when the system has detected that it is low on disk space:

admin_space_left_action = halt

System halted by auditd "The audit daemon is now halting the system"

System shutdown with messages logs showing "The audit daemon is now halting the system" - Red Hat…