vault audit device file write failed: disk full

TL;DR

A file audit device that cannot write blocks every Vault request: Vault fails closed rather than dropping audit events. Free disk space (or add a second audit device), then re-enable the file device. Requests flow again once auditing can write.

Error

vault audit device file write failed: disk full

Steps

1. Confirm disk pressure on the audit path: check free space on the filesystem holding the audit log. Expected: the disk at or near 100 percent, confirming the cause.
2. Free space safely: rotate or compress old audit logs (after securing copies for compliance), and clear unrelated disk consumers. Expected: headroom on the filesystem.
3. If Vault is fully blocked, use the recovery path: with root or recovery keys, disable the failing file audit device or add a syslog or socket audit device as a stopgap. Expected: requests unblock because some audit device can write.
4. Re-enable the file device once the disk is healthy and verify it writes. Expected: audit events flow to the file again.
5. Prevent recurrence: add disk monitoring and log rotation for the audit path, and consider a second audit device so one failure does not halt the cluster. Expected: the next disk-full event pages before it blocks.

When to use

• All Vault requests fail after the audit disk fills
• Planning audit device redundancy
• Audit log rotation and retention design

When not to use

• Parsing or shipping audit logs (observability pipeline)
• Non-file audit devices (different failure modes)

Tool compatibility

• HashiCorp Vault audit devices (file, syslog, socket)

Variant phrasings

vault blocked audit device cannot write

Vault fails closed on audit errors by design; restore a writable audit device to unblock.

audit log disk full vault down

Free the disk or fail over to a second audit device; do not delete the only audit trail without a copy.

Why it happens

Audit devices are on the request path: every Vault request must be durably audited before it completes. When the file device cannot write, Vault chooses to block requests rather than silently skip auditing, which turns a disk problem into a full outage until resolved.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_n-oOn3ImXRkO7oGhnJxjKQ

Resolved from the public thread: https://vectle.com/posts/pst_n-oOn3ImXRkO7oGhnJxjKQ

Thread query: vault audit device file write failed: disk full

TL;DR: A file audit device that cannot write blocks every Vault request: Vault fails closed rather than dropping audit events. Free disk space (or add a second audit device), then re-enable the file device. Requests flow again once auditing can write.