NSX Manager logs the message: “auditd #### - - Plugin queue is full - Discarding events”

Products

• VMware NSX

Issue/Introduction

• The following message is recorded in /var/log/syslog on NSX Manager.
  

  YYYY-MM-DDTHH:MM:DD.NNNZ ##### auditd #### - -  queue to plugins is full - dropping event
  YYYY-MM-DDTHH:MM:DD.NNNZ ##### auditd #### - - auditd queue full reporting limit reached - ending dropped event notifications  

  
  
  
• The NSX Manager support bundles were generated near the above event.

Environment

VMware NSX

Cause

• The audit subsystem’s plugin queue became temporarily full because a burst of audited commands generated a high rate of audit events.
  
  
• The messages indicate the audit daemon dropped events because the queue depth was exceeded and reporting limits were reached. 
  
  
• When support bundle generation is triggered, the NAPI component within NSX Manager invokes api_roothelper.sh.
   This executes numerous operations/commands requiring sudo access on the appliance, potentially filling the queue with a large number of audit events.

Resolution

These messages provide information about dropped audit events.
This message can be ignored as it has no functional impact on the NSX.