go-audit process dies frequently on a busy system about go-audit HOT 6 CLOSED

/dev/log is a datagram socket and I don't recommend using it for this. There is a way to setup rsyslog to use a stream socket which is much better suited to go-audit message sizes.

from go-audit.

thanks a lot,

trying with these options.

network: udp
address: localhost:514

from go-audit.

unfortunatly died again with the same error message, cleared up error log and started, will get more info on next failure.

from go-audit.

That would be because you are still using a datagram transport mode. If you use tcp or a unix domain socket in stream mode you will remove the transit size limit.

from go-audit.

Thanks, I have turned on TCP reception on that server and update go-audit.yaml, things are looks good so far.
network: tcp
address: localhost:514

from go-audit.

we have minimised logging on that server, so far things looks good.

from go-audit.