Kernel: Event buffer is too long. Any new events are NOT being logged!

Issue

Sometimes you may see the following entries in the /var/log/messages:

Feb 28 13:07:15 jp74 kernel: Event buffer is too long. Any new events are NOT being logged! (events_in_buffer(500000) >= max_events(500000)

Environment

• CloudLinux OS
• cloudlinux-file-change-collector

Solution

1. Check the status of the cloudlinux-file-change-collector service:

systemctl status cloudlinux-file-change-collector

2. Flush all data in the buffer:

echo '-1' > /proc/sys/fs/datacycle/flush

3. Recreate the database:

mv /var/lve/cloudlinux-fchange.db /var/lve/cloudlinux-fchange.db.broken

4. Restart the service:

systemctl restart cloudlinux-file-change-collector

[root@nj-s2 ~]# systemctl status cloudlinux-file-change-collector
● cloudlinux-file-change-collector.service - CloudLinux file change events collector
   Loaded: loaded (/usr/lib/systemd/system/cloudlinux-file-change-collector.service; enabled; vendor preset: disabled)
   Active: active (running) since Tue 2023-06-06 07:00:46 EDT; 5s ago
 Main PID: 4744 (cloudlinux-file)
   CGroup: /system.slice/cloudlinux-file-change-collector.service
           └─4744 /usr/bin/python /usr/sbin/cloudlinux-file-change-collector --no-daemon start

Jun 06 07:00:46 nj-s2.serverpanel.net systemd[1]: Started CloudLinux file change events collector.

Useful links

https://docs.cloudlinux.com/cloudlinux_os_kernel/#file-change-api