Storage Efficiency anomaly caused audit logs to be truncated
Applies to
- ONTAP 9.
- Storage Efficiency anomaly alert on Active IQ Unified Manager (AIQUM).
- Audit logs.
Issue
- Alert on AIQUM:
Risk - Volume storage efficiency anomaly
Impact Area - Capacity
Severity - Warning
State - New
Source - vserver_02:/vol_02
Cluster Name - cluster-01
Cluster FQDN - cluster-01.somedomain.lokal
Trigger Condition - The behavior of volume storage efficiency is not following its historical established pattern.
- EMS logs:
[?] Sat Sep 03 01:59:44 +0200 [cluster-01: mgwd:audit.log.event:notice]: Auditing error (Audit messages started to drop. Reason = No buffer space available) occurred at 2022-09-0301:59:44. [?] Sat Sep 03 01:59:45 +0200 [cluster-01: mgwd: audit.log.event:notice]: Auditing error (Audit messages transmissionresumed.) occurred at 2022-09-03 01:59:45. [?] Sat Sep 03 01:59:54 +0200 [cluster-01: mgwd: audit.log.event:notice]: Auditing error(Audit messages started to drop. Reason = No buffer space available) occurred at 2022-09-03 01:59:54. [?] Sat Sep 03 01:59:59 +0200 [cluster-01: mgwd: audit.log.event:notice]: Auditing error (Audit messages transmission resumed.) occurred at 2022-09-03 01:59:59.