Auditd service fails with : " Email option is specified but /usr/lib/sendmail doesn't seem executable "

Solution Verified - Updated -

Issue

  • After starting the audit service, audit files are generated but getting below mentioned error.

    # journalctl -u auditd
    
    Dec 21 12:18:04 localhost systemd[1]: Starting Security Auditing Service...
    Dec 21 12:18:04 localhost auditd[781]: Email option is specified but /usr/lib/sendmail doesn't seem executable.
    Dec 21 12:18:04 localhost auditd[785]: audit dispatcher initialized with q_depth=2000 and 1 active plugins
    Dec 21 12:18:04 localhost auditd[785]: Init complete, auditd 3.1.2 listening for events (startup state enable)
    
  • Found below logs in /var/log/messages :

    Nov 29 05:11:45 localhost systemd[1]: Starting Security Auditing Service...
    Nov 29 05:11:45 localhost auditd[1686]: audit log is not writable by owner
    Nov 29 05:11:45 localhost auditd[1686]: Email option is specified but /usr/lib/sendmail doesn't seem executable.
    Nov 29 05:11:45 localhost auditd[1688]: Audit daemon rotating log files
    Nov 29 05:11:45 localhost auditd[1688]: audit dispatcher initialized with q_depth=1200 and 1 active plugins
    Nov 29 05:11:45 localhost auditd[1688]: Init complete, auditd 3.0.7 listening for events (startup state enable)
    Nov 29 05:11:45 localhost systemd[1]: Started RPC Bind.
    

Environment

  • Red Hat Enterprise linux 8

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content