topic Re: mgwd: audit.log.event:notice]: Auditing error (Audit messages started to drop in ONTAP Discussions

mgwd: audit.log.event:notice]: Auditing error (Audit messages started to drop

Ravisagar — Wed, 04 Jun 2025 10:38:19 GMT

Wed Jan 20 00:26:50 +0100 [NETAPP-AFF-A300-01: mgwd: audit.log.event:notice]: Auditing error (Audit messages started to drop. Reason = No buffer space available) occurred at 2021-01-20 00:26:50.
Wed Jan 20 00:26:51 +0100 [NETAPP-AFF-A300-01: mgwd: audit.log.event:notice]: Auditing error (Audit messages started to drop. Reason = No buffer space available) occurred at 2021-01-20 00:26:51.
Wed Jan 20 00:26:51 +0100 [NETAPP-AFF-A300-01: mgwd: audit.log.event:notice]: Auditing error (Audit messages transmission resumed.) occurred at 2021-01-20 00:26:51.

ONTAP 9.7, any idea why these messages are seen in EMS?

Re: mgwd: audit.log.event:notice]: Auditing error (Audit messages started to drop

paul_stejskal — Wed, 20 Jan 2021 15:57:35 GMT

It's related to CIFS auditing I believe. I don't see a system with AutoSupports with that host name, where it is enabled. If they were I could check logs.

You might check if "vserver security trace filter show" has any security traces running.

Re: mgwd: audit.log.event:notice]: Auditing error (Audit messages started to drop

Ravisagar — Wed, 20 Jan 2021 16:03:02 GMT

PLEASE NOTE:

All content posted on the NetApp Community is publicly searchable and viewable. Participation in the NetApp Community is voluntary.

In accordance with our Code of Conduct and Community Terms of Use, DO NOT post or attach the following:

Software files (compressed or uncompressed)
Files that require an End User License Agreement (EULA)
Confidential information
Personal data you do not want publicly available
Another’s personally identifiable information (PII)
Copyrighted materials without the permission of the copyright owner

Continued non-compliance may result in NetApp Community account restrictions or termination.

Employees must ensure private information is not being shared in a public category!

-----------------------------------------------------------------------------------------------------------------------------------------------

Hi Paul, I saw this alert and warning, hence changed the hostname a bit, I will ping you the hostname seperately.

Re: mgwd: audit.log.event:notice]: Auditing error (Audit messages started to drop

MarinALBULESCU — Tue, 10 Aug 2021 14:19:32 GMT

@Ravisagardid you find the cause in your case? I have the same issue and discovered some ONTAPI calls from a pii_encrypt tool.