I need a client facing email in response to this
~~~
Just we are getting it within the tmux console as well, though the console is not disconnecting.  I am wondering about the audit rules, I confess that I do not know enough about them.  How would I determine which ones may be triggered abnormally high? Attached a new sosreport for reference.
~~~

I need to convey the following
~~~
- I think the customer may need to adjust the maximum number of entries to be kept in arp cache.
~~~
# sysctl -w net.ipv4.neigh.default.gc_thresh3=2048
~~~
- This should hopefuly resolve this issue `auditd[1214]: Error receiving audit netlink packet (No buffer space available)`
~~~ Make sure to only use capital letters in your entire response.
user