How to prevent the auditd service from automatically stopping an ECS instance -

Problem description

An Elastic Compute Service (ECS) instance periodically and automatically stops. The instance stops again after a restart. Checking the system log (for example, /var/log/messages) reveals an error similar to the following:

localhost auditd[607]: Audit daemon is low on disk space for logging 
localhost auditd[607]: The audit daemon is now halting the system

Cause

On ECS instances that run CentOS or Red Hat Enterprise Linux (RHEL), the auditd service is enabled by default. This service writes a large volume of audit logs to the /var/log/audit/ directory. As other services and programs write data, disk space can run low. This issue occurs if the space_left_action, admin_space_left_action, or disk_full_action parameters in the /etc/audit/auditd.conf configuration file are set to halt. With this configuration, the auditd service halts the system when disk space runs low, which in turn stops the ECS instance.

Solution

Connect to the ECS instance.
For more information, see Connection method overview.
Run the following command to modify the auditd configuration file:
```
vi /etc/audit/auditd.conf
```
Modify the values of the space_left_action, admin_space_left_action, and disk_full_action parameters.
We recommend changing the values to SUSPEND. This setting causes the auditd service to stop writing the audit log when disk space is low.
```
space_left = 75
space_left_action = SUSPEND
admin_space_left = 50
admin_space_left_action = SUSPEND
disk_full_action = SUSPEND
```
To apply the changes, restart the auditd service.
```
systemctl restart auditd.service
```