LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Red Hat
User Name
Password
Red Hat This forum is for the discussion of Red Hat Linux.

Notices

Reply
 
Search this Thread
Old 10-11-2007, 07:44 AM   #1
cmschube
LQ Newbie
 
Registered: Oct 2007
Posts: 6

Rep: Reputation: 0
Question auditd: auditd startup failed


Hello,

I'm having issues getting auditd started (obviously). I just installed SNARE on a RHEL3 box and when it tries to start, it fails. Here is my log..

**SNIP***
Oct 9 16:00:18 lnx001 audit: auditd shutdown failed
Oct 9 16:01:18 lnx001 auditd: auditd shutdown failed
Oct 9 16:01:18 lnx001 auditd[4344]: Started dispatcher: /usr/sbin/SnareDispatcher pid: 4346
Oct 9 16:01:18 lnx001 auditd[4344]: Unable to set audit pid, exiting
Oct 9 16:01:18 lnx001 auditd[4344]: The audit daemon is exiting.
Oct 9 16:01:18 lnx001 auditd: Cannot daemonize (Interrupted system call)
Oct 9 16:01:18 lnx001 auditd: The audit daemon is exiting.
Oct 9 16:01:18 lnx001 auditd: auditd startup failed
Oct 9 16:02:33 lnx001 auditd[4423]: Started dispatcher: /usr/sbin/SnareDispatcher pid: 4425
Oct 9 16:02:33 lnx001 auditd[4423]: Unable to set audit pid, exiting
Oct 9 16:02:33 lnx001 auditd[4423]: The audit daemon is exiting.
Oct 9 16:02:33 lnx001 auditd: Cannot daemonize (No child processes)
Oct 9 16:02:33 lnx001 auditd: The audit daemon is exiting.
Oct 9 16:02:33 lnx001 auditd: auditd startup failed
**SNIP***

Any ideas?

Thanks,

cmschube
 
Old 09-20-2008, 01:27 PM   #2
akeker
LQ Newbie
 
Registered: Sep 2008
Posts: 2

Rep: Reputation: 0
Quote:
Originally Posted by cmschube View Post
Hello,

I'm having issues getting auditd started (obviously). I just installed SNARE on a RHEL3 box and when it tries to start, it fails. Here is my log..

**SNIP***
Oct 9 16:00:18 lnx001 audit: auditd shutdown failed
Oct 9 16:01:18 lnx001 auditd: auditd shutdown failed
Oct 9 16:01:18 lnx001 auditd[4344]: Started dispatcher: /usr/sbin/SnareDispatcher pid: 4346
Oct 9 16:01:18 lnx001 auditd[4344]: Unable to set audit pid, exiting
Oct 9 16:01:18 lnx001 auditd[4344]: The audit daemon is exiting.
Oct 9 16:01:18 lnx001 auditd: Cannot daemonize (Interrupted system call)
Oct 9 16:01:18 lnx001 auditd: The audit daemon is exiting.
Oct 9 16:01:18 lnx001 auditd: auditd startup failed
Oct 9 16:02:33 lnx001 auditd[4423]: Started dispatcher: /usr/sbin/SnareDispatcher pid: 4425
Oct 9 16:02:33 lnx001 auditd[4423]: Unable to set audit pid, exiting
Oct 9 16:02:33 lnx001 auditd[4423]: The audit daemon is exiting.
Oct 9 16:02:33 lnx001 auditd: Cannot daemonize (No child processes)
Oct 9 16:02:33 lnx001 auditd: The audit daemon is exiting.
Oct 9 16:02:33 lnx001 auditd: auditd startup failed
**SNIP***

Any ideas?

Thanks,

cmschube
I've got the same problem either. How to solve this.
 
Old 05-11-2009, 07:08 AM   #3
bradleyjr
LQ Newbie
 
Registered: Nov 2008
Posts: 6

Rep: Reputation: 0
Lightbulb auditd fails to start after snare install

I had the same issue with Red hat 5.
There are permissions to check on 2 files to get this corrected

# chmod 0600 /var/log/audit/audit.log
# chmod 0750 /usr/share/SnareDispatchHelper

Wah-Lah!

now you can open Snare web utility using

http://127.0.0.1:6161 (that's if you stayed with the defaulf config)

also if you check again and run

# /etc/init.d/auditd start OK

instead of [FAILED]

if this doesn't do the trick, check your

/var/log messages for answers

happy auditing
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
auditd exceptions and thesholds adrianmarsh Red Hat 0 08-06-2007 07:23 PM
Linux auditd configuration papasj Linux - Security 1 04-29-2007 03:57 AM
Auditd Daemon Threshold xmdms Linux - Enterprise 4 08-12-2006 10:30 AM
auditd and laus kronixx Red Hat 0 07-15-2005 05:33 PM
Help with crond and auditd pfaendtner Linux - Software 4 04-25-2005 10:41 AM


All times are GMT -5. The time now is 03:34 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration