Why does the system shut down abruptly with auditd service error?

Solution Verified - Updated -

Environment

  • Red Hat Enterprise Linux (All versions)

Issue

  • The system is not booting. Shuts down automatically during boot sequence with error for Security Auditing Service:
 [ ***  ] A stop job is running for Security Auditing Service (1min / 1min 30s)
  • The system halts abruptly with Security Auditing Service error

Resolution

  • Check the audit settings in /etc/auditd/auditd.conf and specifically check fields space_left_action,admin_space_left_action,disk_full_action, disk_error_action and overflow_action
  • If either of them has halt specified, check if the corresponding condition is met.
    If /var/log/audit is full and admin_space_left_action is set to halt, then the audit daemon will shutdown the computer system citing low disk space.

Root Cause

  • admin_space_left defines min value (in megabytes) for free space below which configured action will be performed by audit daemon.
    • admin_space_left_action defines the action that audit daemon will perform. The possible values are ignore,syslog,rotate,email,exec,suspend,single and halt.
  • The halt option will cause the audit daemon to shutdown the computer system.

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.

Comments