The auditd backlog limit is too small and a privilege escalation burst drops the very exec events the investigation needs

The host stays online, but the audit trail is incomplete because event pressure outran the queue design.