When a user/process hits a ulimit is there a way to log this at the system level? I cannot find any logging information in /var/log/messages, or dmesg. I did some preliminary research and the answer is that the application has to 'detect' this; is there a way to just globally log when these limits are reached?


1 Answer 1



The above is an attempt to monitor failed syscalls with auditd and then determine when/if that was due to ulimit - I think that's as close as you can get without modifying the kernel and/or PAM to directly dump such events to log.

  • do the auditd rules persist between reboot, or do they need to be run every time Feb 6, 2018 at 15:45

You must log in to answer this question.