启动audit服务报错

鸣一

已于 2023-08-24 18:11:50 修改

阅读量1.2k

点赞数

文章标签： centos audit

于 2023-08-24 17:36:51 首次发布

本文链接：https://blog.csdn.net/mdming412/article/details/132479137

版权

启动centos audit服务报错

错误信息

$service auditd restart Stopping logging:
[FAILED] Redirecting start to /bin/systemctl start auditd.service Job
for auditd.service failed because the control process exited with
error code. See “systemctl status auditd.service” and “journalctl -xe”
for details.

分析

在这里插入图片描述

解决

$ mkdir -p /var/log/audit
$ ll /var/log | grep audit
drwxr-xr-x   2 root   root           6 8月  24 17:34 audit

$ service auditd restart
Stopping logging:                                          [FAILED]
Redirecting start to /bin/systemctl start auditd.service

$ systemctl status auditd
OK

OK解决了

附：
配置文件

vim /etc/audit/auditd.conf

$ auditctl -s
enabled 1
failure 1
pid 855204
rate_limit 0
backlog_limit 8192
lost 0
backlog 0
loginuid_immutable 0 unlocked

auditctl -l # list all rules

附link :

https://guoflight.github.io/posts/63889/#:~:text=cat%20%2Fvar%2Flog%2Faudit%2Faudit.log,%E4%BE%8B%E5%A6%82%EF%BC%9A%E8%BF%90%E8%A1%8C%E5%91%BD%E4%BB%A4rm%20-rf%20%2Froot%2F123