Audit service is not starting, not even after reboot
Issue
- Audit service is not starting, not even after reboot.
- Audit service is not starting due to "
ConditionKernelCommandLine=!audit=0was not met". - Getting below error in audit service status.
# systemctl status auditd -l
● auditd.service - Security Auditing Service
Loaded: loaded (/usr/lib/systemd/system/auditd.service; enabled; vendor preset: enabled)
Active: inactive (dead)
Condition: start condition failed at Wed 2020-11-11 12:26:29 EST; 19h ago
ConditionKernelCommandLine=!audit=0 was not met
Docs: man:auditd(8)
https://github.com/linux-audit/audit-documentation
Oct 17 18:35:09 svl-tibbc-d39 systemd[1]: Couldn't determine result for ConditionKernelCommandLine=!audit=0 for auditd.service, assuming failed: Invalid argument
Nov 11 12:26:29 svl-tibbc-d39 systemd[1]: Couldn't determine result for ConditionKernelCommandLine=!audit=0 for auditd.service, assuming failed: Invalid argument
#
Environment
- Red Hat Enterprise Linux 7
- auditd
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.