Auditd service fails to start at boot.
Issue
-
The auditd service fails to start at boot and manually with systemctl.
-
When auditd fails, it reports directive is not found in /etc/audit/auditd.conf configuration file.
# journalctl -u auditd Jan 15 09:39:17 abchost auditd[7592]: Option root not found - line 20 Jan 15 09:39:17 abchost auditd[7592]: The audit daemon is exiting. Jan 15 09:39:17 abchost systemd[1]: auditd.service: Control process exited, code=exited status=6 Jan 15 09:39:17 abchost systemd[1]: auditd.service: Failed with result 'exit-code'.
Environment
- Red Hat Enterprise Linux 8
- audit
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.