How to prevent the auditd service from automatically stopping an ECS instance -

Problem description

An ECS instance intermittently powers off spontaneously. After a restart, the issue recurs. The system log (for example, /var/log/messages) shows an error similar to the following:

localhost auditd[607]: Audit daemon is low on disk space for logging 
localhost auditd[607]: The audit daemon is now halting the system

Cause

On CentOS or Red Hat Enterprise Linux (RHEL) ECS instances, the auditd service is enabled by default and writes audit logs to /var/log/audit/. As other services consume disk space, the disk can fill up. If the space_left_action, admin_space_left_action, or disk_full_action parameters in /etc/audit/auditd.conf are set to halt, auditd halts the system when disk space is low, stopping the ECS instance.

Solution

Connect to the ECS instance.
See Connection method overview.
Modify the auditd configuration file:
```
vi /etc/audit/auditd.conf
```
Set the space_left_action, admin_space_left_action, and disk_full_action parameters.
Set these parameters to SUSPEND so auditd stops writing audit logs when disk space is low instead of halting the system.
```
space_left = 75
space_left_action = SUSPEND
admin_space_left = 50
admin_space_left_action = SUSPEND
disk_full_action = SUSPEND
```
Restart the auditd service to apply the changes.
```
systemctl restart auditd.service
```