sudo systemctl restart auditd
> Failed to restart auditd.service: Operation refused, unit
> auditd.service may be requested by dependency only (it is configured
> to refuse manual start/stop). See system logs and 'systemctl status
> auditd.service' for details.
systemctl 无法重启 auditd, 换用service可以正常重启
sudo service auditd restart
Stopping logging: [ OK ]
Redirecting start to /bin/systemctl start auditd.service