Auditd service failing with the an error "/sbin/auditd: No such file or directory"

Solution Verified - Updated -

Issue

  • auditd.service is failing with the following error:
* auditd.service - Security Auditing Service
   Loaded: loaded (/usr/lib/systemd/system/auditd.service; enabled; vendor preset: enabled)
   Active: failed (Result: exit-code) since Thu 2020-10-01 05:55:45 CDT; 19min ago
     Docs: man:auditd(8)
           https://github.com/linux-audit/audit-documentation
  Process: 70195 ExecStart=/sbin/auditd (code=exited, status=219/CGROUP)
 Main PID: 1334 (code=exited, status=0/SUCCESS)

Oct 01 05:55:45  systemd[1]: Starting Security Auditing Service...
Oct 01 05:55:45  systemd[1]: auditd.service: control process exited, code=exited status=219
Oct 01 05:55:45  systemd[1]: Failed to start Security Auditing Service.
Oct 01 05:55:45  systemd[1]: Unit auditd.service entered failed state.
Oct 01 05:55:45  systemd[1]: auditd.service failed.
  • In /var/log/messages file the below error messages are found.
 systemd[70195]: Failed at step CGROUP spawning /sbin/auditd: No such file or directory
  Subject: Process /sbin/auditd could not be executed

Environment

  • Red Hat Enterprise Linux (RHEL) 7
  • auditd

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content