Failed to start Auditd Service on RHEL 8

Solution Verified - Updated -

Issue

  • Auditd service fails to start at boot and with systemctl in RHEL 8.

  • When auditd fails, it reports wrong argument in /etc/audit/auditd.conf configuration file.

    # journalctl -u auditd

Jan 03 14:19:39 node1.example.com auditd[4080816]: Email option is specified but /usr/lib/sendmail doesn't seem executable.
Jan 03 14:19:39 node1.example.com auditd[4080816]: Wrong number of arguments for line 41 in /etc/audit/auditd.conf 
Jan 03 14:19:39 node1.example.com auditd[4080816]: Not processing any more lines in /etc/audit/auditd.conf
Jan 03 14:19:3 node1.example.com  auditd[4080816]: The audit daemon is exiting.

Environment

  • Red Hat Enterprise Linux 8
  • Audit

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content