Audit service is not starting, not even after reboot

Solution Verified - Updated -

Issue

  • Audit service is not starting, not even after reboot.
  • Audit service is not starting due to "ConditionKernelCommandLine=!audit=0 was not met".
  • Getting below error in audit service status.
# systemctl status auditd -l
● auditd.service - Security Auditing Service
   Loaded: loaded (/usr/lib/systemd/system/auditd.service; enabled; vendor preset: enabled)
   Active: inactive (dead)
Condition: start condition failed at Wed 2020-11-11 12:26:29 EST; 19h ago
           ConditionKernelCommandLine=!audit=0 was not met
     Docs: man:auditd(8)
           https://github.com/linux-audit/audit-documentation

Oct 17 18:35:09 svl-tibbc-d39 systemd[1]: Couldn't determine result for ConditionKernelCommandLine=!audit=0 for auditd.service, assuming failed: Invalid argument
Nov 11 12:26:29 svl-tibbc-d39 systemd[1]: Couldn't determine result for ConditionKernelCommandLine=!audit=0 for auditd.service, assuming failed: Invalid argument
#

Environment

  • Red Hat Enterprise Linux 7
  • auditd

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content