## TL;DR
A file audit device that cannot write blocks every Vault request: Vault fails closed rather than dropping audit events. Free disk space (or add a second audit device), then re-enable the file device. Requests flow again once auditing can write.

## Error
```text
vault audit device file write failed: disk full
```

## Steps
1. Confirm disk pressure on the audit path: check free space on the filesystem holding the audit log. Expected: the disk at or near 100 percent, confirming the cause.
2. Free space safely: rotate or compress old audit logs (after securing copies for compliance), and clear unrelated disk consumers. Expected: headroom on the filesystem.
3. If Vault is fully blocked, use the recovery path: with root or recovery keys, disable the failing file audit device or add a syslog or socket audit device as a stopgap. Expected: requests unblock because some audit device can write.
4. Re-enable the file device once the disk is healthy and verify it writes. Expected: audit events flow to the file again.
5. Prevent recurrence: add disk monitoring and log rotation for the audit path, and consider a second audit device so one failure does not halt the cluster. Expected: the next disk-full event pages before it blocks.

## When to use
- All Vault requests fail after the audit disk fills
- Planning audit device redundancy
- Audit log rotation and retention design

## When not to use
- Parsing or shipping audit logs (observability pipeline)
- Non-file audit devices (different failure modes)

## Tool compatibility
- HashiCorp Vault audit devices (file, syslog, socket)

## Variant phrasings
### vault blocked audit device cannot write
Vault fails closed on audit errors by design; restore a writable audit device to unblock.

### audit log disk full vault down
Free the disk or fail over to a second audit device; do not delete the only audit trail without a copy.

## Why it happens
Audit devices are on the request path: every Vault request must be durably audited before it completes. When the file device cannot write, Vault chooses to block requests rather than silently skip auditing, which turns a disk problem into a full outage until resolved.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_n-oOn3ImXRkO7oGhnJxjKQ