Failed to start Security Auditing Service

➜  ~ systemctl status auditd       
× auditd.service - Security Auditing Service
     Loaded: loaded (/usr/lib/systemd/system/auditd.service; enabled; vendor preset: enabled)
     Active: failed (Result: exit-code) since Thu 2022-03-10 07:29:54 IST; 14h ago
       Docs: man:auditd(8)
             https://github.com/linux-audit/audit-documentation
    Process: 4832 ExecStart=/sbin/auditd (code=exited, status=6)
        CPU: 16ms

Mar 10 07:29:54 fedora systemd[1]: auditd.service: Scheduled restart job, restart counter is at 5.
Mar 10 07:29:54 fedora systemd[1]: Stopped Security Auditing Service.
Mar 10 07:29:54 fedora systemd[1]: auditd.service: Start request repeated too quickly.
Mar 10 07:29:54 fedora systemd[1]: auditd.service: Failed with result 'exit-code'.
Mar 10 07:29:54 fedora systemd[1]: Failed to start Security Auditing Service.

I am getting this error during boot, how could I fix this issue?

Thanks for your help in advance.

Can you post the output of journalctl -b -u auditd?

1 Like
➜  ~ journalctl -b -u auditd
Mar 10 07:21:03 fedora systemd[1]: Starting Security Auditing Service...
Mar 10 07:21:03 fedora auditd[837]: Could not open dir /var/log/audit (No such file or directory)
Mar 10 07:21:03 fedora auditd[837]: The audit daemon is exiting.
Mar 10 07:21:03 fedora systemd[1]: auditd.service: Control process exited, code=exited, status=6/NOTCONFIGURED
Mar 10 07:21:03 fedora systemd[1]: auditd.service: Failed with result 'exit-code'.
Mar 10 07:21:03 fedora systemd[1]: Failed to start Security Auditing Service.
Mar 10 07:21:03 fedora systemd[1]: auditd.service: Scheduled restart job, restart counter is at 1.
Mar 10 07:21:03 fedora systemd[1]: Stopped Security Auditing Service.
Mar 10 07:21:03 fedora systemd[1]: Starting Security Auditing Service...
Mar 10 07:21:03 fedora auditd[874]: Could not open dir /var/log/audit (No such file or directory)
Mar 10 07:21:03 fedora auditd[874]: The audit daemon is exiting.
Mar 10 07:21:03 fedora systemd[1]: auditd.service: Control process exited, code=exited, status=6/NOTCONFIGURED
Mar 10 07:21:03 fedora systemd[1]: auditd.service: Failed with result 'exit-code'.
Mar 10 07:21:03 fedora systemd[1]: Failed to start Security Auditing Service.
Mar 10 07:21:03 fedora systemd[1]: auditd.service: Scheduled restart job, restart counter is at 2.
Mar 10 07:21:03 fedora systemd[1]: Stopped Security Auditing Service.
Mar 10 07:21:03 fedora systemd[1]: Starting Security Auditing Service...
Mar 10 07:21:03 fedora auditd[940]: Could not open dir /var/log/audit (No such file or directory)
Mar 10 07:21:03 fedora auditd[940]: The audit daemon is exiting.
Mar 10 07:21:03 fedora systemd[1]: auditd.service: Control process exited, code=exited, status=6/NOTCONFIGURED
Mar 10 07:21:03 fedora systemd[1]: auditd.service: Failed with result 'exit-code'.
Mar 10 07:21:03 fedora systemd[1]: Failed to start Security Auditing Service.
Mar 10 07:21:03 fedora systemd[1]: auditd.service: Scheduled restart job, restart counter is at 3.
Mar 10 07:21:03 fedora systemd[1]: Stopped Security Auditing Service.
Mar 10 07:21:03 fedora systemd[1]: Starting Security Auditing Service...
Mar 10 07:21:03 fedora auditd[958]: Could not open dir /var/log/audit (No such file or directory)
Mar 10 07:21:03 fedora auditd[958]: The audit daemon is exiting.
Mar 10 07:21:03 fedora systemd[1]: auditd.service: Control process exited, code=exited, status=6/NOTCONFIGURED
Mar 10 07:21:03 fedora systemd[1]: auditd.service: Failed with result 'exit-code'.
Mar 10 07:21:03 fedora systemd[1]: Failed to start Security Auditing Service.
Mar 10 07:21:04 fedora systemd[1]: auditd.service: Scheduled restart job, restart counter is at 4.
Mar 10 07:21:04 fedora systemd[1]: Stopped Security Auditing Service.
Mar 10 07:21:04 fedora systemd[1]: Starting Security Auditing Service...
Mar 10 07:21:03 fedora systemd[1]: Failed to start Security Auditing Service.
Mar 10 07:21:04 fedora systemd[1]: auditd.service: Scheduled restart job, restart counter is at 4.
Mar 10 07:21:04 fedora systemd[1]: Stopped Security Auditing Service.
Mar 10 07:21:04 fedora systemd[1]: Starting Security Auditing Service...
Mar 10 07:21:04 fedora auditd[992]: Could not open dir /var/log/audit (No such file or directory)
Mar 10 07:21:04 fedora auditd[992]: The audit daemon is exiting.
Mar 10 07:21:04 fedora systemd[1]: auditd.service: Control process exited, code=exited, status=6/NOTCONFIGURED
Mar 10 07:21:04 fedora systemd[1]: auditd.service: Failed with result 'exit-code'.
Mar 10 07:21:04 fedora systemd[1]: Failed to start Security Auditing Service.
Mar 10 07:21:04 fedora systemd[1]: auditd.service: Scheduled restart job, restart counter is at 5.
Mar 10 07:21:04 fedora systemd[1]: Stopped Security Auditing Service.
Mar 10 07:21:04 fedora systemd[1]: auditd.service: Start request repeated too quickly.
Mar 10 07:21:04 fedora systemd[1]: auditd.service: Failed with result 'exit-code'.
Mar 10 07:21:04 fedora systemd[1]: Failed to start Security Auditing Service.
Mar 10 07:29:53 fedora systemd[1]: Starting Security Auditing Service...
Mar 10 07:29:53 fedora auditd[4809]: Could not open dir /var/log/audit (No such file or directory)
Mar 10 07:29:53 fedora auditd[4809]: The audit daemon is exiting.
Mar 10 07:29:53 fedora systemd[1]: auditd.service: Control process exited, code=exited, status=6/NOTCONFIGURED
Mar 10 07:29:53 fedora systemd[1]: auditd.service: Failed with result 'exit-code'.
Mar 10 07:29:53 fedora systemd[1]: Failed to start Security Auditing Service.
Mar 10 07:29:53 fedora systemd[1]: auditd.service: Scheduled restart job, restart counter is at 1.
Mar 10 07:29:53 fedora systemd[1]: Stopped Security Auditing Service.
Mar 10 07:29:53 fedora systemd[1]: Starting Security Auditing Service...
Mar 10 07:29:53 fedora auditd[4829]: Could not open dir /var/log/audit (No such file or directory)
Mar 10 07:29:53 fedora auditd[4829]: The audit daemon is exiting.
Mar 10 07:29:53 fedora systemd[1]: auditd.service: Control process exited, code=exited, status=6/NOTCONFIGURED
Mar 10 07:29:53 fedora systemd[1]: auditd.service: Failed with result 'exit-code'.
Mar 10 07:29:53 fedora systemd[1]: Failed to start Security Auditing Service.
Mar 10 07:29:54 fedora systemd[1]: auditd.service: Scheduled restart job, restart counter is at 2.
Mar 10 07:29:54 fedora systemd[1]: Stopped Security Auditing Service.
Mar 10 07:29:54 fedora systemd[1]: Starting Security Auditing Service...
Mar 10 07:29:54 fedora auditd[4830]: Could not open dir /var/log/audit (No such file or directory)
Mar 10 07:29:54 fedora auditd[4830]: The audit daemon is exiting.
Mar 10 07:29:54 fedora systemd[1]: auditd.service: Control process exited, code=exited, status=6/NOTCONFIGURED
Mar 10 07:29:54 fedora systemd[1]: auditd.service: Failed with result 'exit-code'.
Mar 10 07:29:54 fedora systemd[1]: Failed to start Security Auditing Service.
Mar 10 07:29:54 fedora systemd[1]: auditd.service: Scheduled restart job, restart counter is at 3.
Mar 10 07:29:54 fedora systemd[1]: Stopped Security Auditing Service.
Mar 10 07:29:54 fedora systemd[1]: Starting Security Auditing Service...
Mar 10 07:29:54 fedora auditd[4831]: Could not open dir /var/log/audit (No such file or directory)
Mar 10 07:29:54 fedora auditd[4831]: The audit daemon is exiting.
Mar 10 07:29:54 fedora systemd[1]: auditd.service: Control process exited, code=exited, status=6/NOTCONFIGURED
Mar 10 07:29:54 fedora systemd[1]: auditd.service: Failed with result 'exit-code'.
Mar 10 07:29:54 fedora systemd[1]: Failed to start Security Auditing Service.
Mar 10 07:29:54 fedora systemd[1]: auditd.service: Scheduled restart job, restart counter is at 4.
Mar 10 07:29:54 fedora systemd[1]: Stopped Security Auditing Service.
Mar 10 07:29:54 fedora systemd[1]: Starting Security Auditing Service...
Mar 10 07:29:54 fedora auditd[4832]: Could not open dir /var/log/audit (No such file or directory)
Mar 10 07:29:54 fedora auditd[4832]: The audit daemon is exiting.
Mar 10 07:29:54 fedora systemd[1]: auditd.service: Control process exited, code=exited, status=6/NOTCONFIGURED
Mar 10 07:29:54 fedora systemd[1]: auditd.service: Failed with result 'exit-code'.
Mar 10 07:29:54 fedora systemd[1]: Failed to start Security Auditing Service.
Mar 10 07:29:54 fedora systemd[1]: auditd.service: Scheduled restart job, restart counter is at 5.
Mar 10 07:29:54 fedora systemd[1]: Stopped Security Auditing Service.
Mar 10 07:29:54 fedora systemd[1]: auditd.service: Start request repeated too quickly.
Mar 10 07:29:54 fedora systemd[1]: auditd.service: Failed with result 'exit-code'.
Mar 10 07:29:54 fedora systemd[1]: Failed to start Security Auditing Service.
lines 34-86/86 (END)
1 Like

Try reinstalling audit package. This will restore the missing /var/log/audit directory:

sudo dnf reinstall audit

Then:

sudo systemctl reset-failed auditd.service

And then:

sudo systemctl start auditd.service
1 Like

Thanks a lot, it worked :smiley:!
I had tried removing the package and installing it again though, to no avail(giving the same error).
But dnf reinstall worked, why is it so?
Just out of curiosity.

1 Like

Did you run sudo systemctl reset-failed auditd.service after installing it again and before starting the service?

2 Likes

No…
So that’s what made the difference,
thanks again! :grinning:

2 Likes

I found the culprit, stacer!

1 Like