Bug 1225914

Summary:	[Build 6.73] Audit daemon is low on disk space for logging
Product:	[openSUSE] PUBLIC SUSE Linux Enterprise Server 15 SP6	Reporter:	Martin Loviska <mloviska>
Component:	Minimal-VM	Assignee:	E-mail List <jeos-internal>
Status:	NEW ---	QA Contact:	Gustavo Yokoyama Ribeiro <gyribeiro>
Severity:	Normal
Priority:	P5 - None
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://openqa.suse.de/tests/14486026/modules/journal_check/steps/14
Whiteboard:
Found By:	openQA	Services Priority:
Business Priority:		Blocker:	Yes
Marketing QA Status:	---	IT Deployment:	---
Attachments:	boottime, firstboot log, cloud init logs

Description Martin Loviska 2024-06-04 10:38:18 UTC

Created attachment 875294 [details]
boottime, firstboot log, cloud init logs

## Observation

openQA test in scenario sle-15-SP6-JeOS-for-OpenStack-Cloud-x86_64-jeos-no-cloud@64bit fails in
[journal_check](https://openqa.suse.de/tests/14486026/modules/journal_check/steps/14)

While first boot of SLES15-SP6-Minimal-VM.x86_64|aarch64-Cloud images, we can see that that auditd reports low disk space

> Jun 04 12:09:07 localhost systemd[1]: Starting Commit a transient machine-id on disk...
Jun 04 12:09:07 localhost systemd[1]: Starting Create Volatile Files and Directories...
Jun 04 12:09:07 localhost systemd[1]: etc-machine\x2did.mount: Deactivated successfully.
> Jun 04 12:09:07 localhost systemd[1]: Finished Commit a transient machine-id on disk.
> Jun 04 12:09:07 localhost systemd[1]: Finished Create Volatile Files and Directories.
> Jun 04 12:09:07 localhost systemd[1]: Starting Security Auditing Service...
> Jun 04 12:09:07 localhost systemd[1]: Starting Rebuild Journal Catalog...
> Jun 04 12:09:07 localhost systemd[1]: Finished Early Kernel Boot Messages.
> Jun 04 12:09:07 localhost systemd[1]: Finished Rebuild Journal Catalog.
> Jun 04 12:09:07 localhost systemd[1]: Starting Update is Completed...
> Jun 04 12:09:07 localhost systemd[1]: Finished Update is Completed.
> Jun 04 12:09:07 localhost auditd[688]: Audit daemon is low on disk space for logging
> Jun 04 12:09:07 localhost auditd[688]: No plugins found, not dispatching events
> Jun 04 12:09:07 localhost auditd[688]: Init complete, auditd 3.0.6 listening for events (startup state enable)
> Jun 04 12:09:07 localhost systemd[1]: Started Security Auditing Service.
> Jun 04 12:09:07 localhost systemd[1]: Starting Record System Boot/Shutdown in UTMP...
> Jun 04 12:09:07 localhost systemd[1]: Finished Record System Boot/Shutdown in UTMP.
> Jun 04 12:09:07 localhost systemd[1]: Finished Virtual Console Setup.
> Jun 04 12:09:08 localhost systemd[1]: Finished Load AppArmor profiles.
> Jun 04 12:09:08 localhost systemd[1]: Reached target System Initialization.

# Virtual size of the images

image: SLES15-SP6-Minimal-VM.aarch64-Cloud-Build6.73.qcow2
file format: qcow2
virtual size: 979 MiB (1026555904 bytes)
disk size: 268 MiB
cluster_size: 65536
Format specific information:
    compat: 1.1
    compression type: zlib
    lazy refcounts: false
    refcount bits: 16
    corrupt: false
    extended l2: false

image: SLES15-SP6-Minimal-VM.x86_64-Cloud-Build6.73.qcow2
file format: qcow2
virtual size: 854 MiB (895483904 bytes)
disk size: 279 MiB
cluster_size: 65536
Format specific information:
    compat: 1.1
    compression type: zlib
    lazy refcounts: false
    refcount bits: 16
    corrupt: false
    extended l2: false

Just for the compare reason, virtual size of kvm-and-xen image

image: SLES15-SP6-Minimal-VM.x86_64-kvm-and-xen-Build6.73.qcow2
file format: qcow2
virtual size: 24 GiB (25769803776 bytes)
disk size: 279 MiB
cluster_size: 65536
Format specific information:
    compat: 1.1
    compression type: zlib
    lazy refcounts: false
    refcount bits: 16
    corrupt: false
    extended l2: false

## Reproducible

Fails since (at least) Build [6.73](https://openqa.suse.de/tests/14478608)


## Expected result

Last good: (unknown) (or more recent)


## Further details

Always latest result in this scenario: [latest](https://openqa.suse.de/tests/latest?arch=x86_64&distri=sle&flavor=JeOS-for-OpenStack-Cloud&machine=64bit&test=jeos-no-cloud&version=15-SP6)