When auditctl -s shows a larger lost value than the previous sample, the Linux Audit trail already has a gap. Those discarded records cannot be recovered by emptying the queue, restarting auditd, or increasing -b. The safe response is to preserve the loss boundary, find why records ...