LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Red Hat (https://www.linuxquestions.org/questions/red-hat-31/)
-   -   auditd: auditd startup failed (https://www.linuxquestions.org/questions/red-hat-31/auditd-auditd-startup-failed-591040/)

cmschube 10-11-2007 07:44 AM

auditd: auditd startup failed
 
Hello,

I'm having issues getting auditd started (obviously). I just installed SNARE on a RHEL3 box and when it tries to start, it fails. Here is my log..

**SNIP***
Oct 9 16:00:18 lnx001 audit: auditd shutdown failed
Oct 9 16:01:18 lnx001 auditd: auditd shutdown failed
Oct 9 16:01:18 lnx001 auditd[4344]: Started dispatcher: /usr/sbin/SnareDispatcher pid: 4346
Oct 9 16:01:18 lnx001 auditd[4344]: Unable to set audit pid, exiting
Oct 9 16:01:18 lnx001 auditd[4344]: The audit daemon is exiting.
Oct 9 16:01:18 lnx001 auditd: Cannot daemonize (Interrupted system call)
Oct 9 16:01:18 lnx001 auditd: The audit daemon is exiting.
Oct 9 16:01:18 lnx001 auditd: auditd startup failed
Oct 9 16:02:33 lnx001 auditd[4423]: Started dispatcher: /usr/sbin/SnareDispatcher pid: 4425
Oct 9 16:02:33 lnx001 auditd[4423]: Unable to set audit pid, exiting
Oct 9 16:02:33 lnx001 auditd[4423]: The audit daemon is exiting.
Oct 9 16:02:33 lnx001 auditd: Cannot daemonize (No child processes)
Oct 9 16:02:33 lnx001 auditd: The audit daemon is exiting.
Oct 9 16:02:33 lnx001 auditd: auditd startup failed
**SNIP***

Any ideas?

Thanks,

cmschube

akeker 09-20-2008 01:27 PM

Quote:

Originally Posted by cmschube (Post 2920743)
Hello,

I'm having issues getting auditd started (obviously). I just installed SNARE on a RHEL3 box and when it tries to start, it fails. Here is my log..

**SNIP***
Oct 9 16:00:18 lnx001 audit: auditd shutdown failed
Oct 9 16:01:18 lnx001 auditd: auditd shutdown failed
Oct 9 16:01:18 lnx001 auditd[4344]: Started dispatcher: /usr/sbin/SnareDispatcher pid: 4346
Oct 9 16:01:18 lnx001 auditd[4344]: Unable to set audit pid, exiting
Oct 9 16:01:18 lnx001 auditd[4344]: The audit daemon is exiting.
Oct 9 16:01:18 lnx001 auditd: Cannot daemonize (Interrupted system call)
Oct 9 16:01:18 lnx001 auditd: The audit daemon is exiting.
Oct 9 16:01:18 lnx001 auditd: auditd startup failed
Oct 9 16:02:33 lnx001 auditd[4423]: Started dispatcher: /usr/sbin/SnareDispatcher pid: 4425
Oct 9 16:02:33 lnx001 auditd[4423]: Unable to set audit pid, exiting
Oct 9 16:02:33 lnx001 auditd[4423]: The audit daemon is exiting.
Oct 9 16:02:33 lnx001 auditd: Cannot daemonize (No child processes)
Oct 9 16:02:33 lnx001 auditd: The audit daemon is exiting.
Oct 9 16:02:33 lnx001 auditd: auditd startup failed
**SNIP***

Any ideas?

Thanks,

cmschube

I've got the same problem either. How to solve this.

bradleyjr 05-11-2009 07:08 AM

auditd fails to start after snare install
 
I had the same issue with Red hat 5.
There are permissions to check on 2 files to get this corrected

# chmod 0600 /var/log/audit/audit.log
# chmod 0750 /usr/share/SnareDispatchHelper

Wah-Lah!

now you can open Snare web utility using

http://127.0.0.1:6161 (that's if you stayed with the defaulf config)

also if you check again and run

# /etc/init.d/auditd start OK

instead of [FAILED]

if this doesn't do the trick, check your

/var/log messages for answers

happy auditing


All times are GMT -5. The time now is 02:50 PM.