LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Enterprise Linux Forums > Linux - Enterprise
User Name
Password
Linux - Enterprise This forum is for all items relating to using Linux in the Enterprise.

Notices


Reply
  Search this Thread
Old 08-10-2018, 11:35 AM   #1
dj_thrive
LQ Newbie
 
Registered: Dec 2016
Location: Huntvsille, AL
Distribution: RedHat 6
Posts: 27

Rep: Reputation: Disabled
Auditing-Can't start auditd


Thanks in advance for your time. I've been struggling with getting auditd to start for a couple of weeks now (I used to use Snare to audit my RHEL 6 system, now I want to switch over to using auditd and aureport). When I run
Code:
service auditd start
or
Code:
service auditd restart
it tells me it FAILED. I have already run
Code:
chmod 750 /var/log/audit
and
Code:
dnf reinstall audit
. I have also tried
Code:
/sbin/auditd
and
Code:
/etc/initd.d/auditd start
I am logged in as admin, and have already run
Code:
su
/var/log/messages didn't have any errors that appeared to pertain to this issue.

Is there something I'm missing, or something else I could try? My audit.conf file appears to be in good shape, and /var/log/audit.log was created.

Thanks again for any assistance you can provide.
 
Old 08-10-2018, 12:50 PM   #2
scasey
Senior Member
 
Registered: Feb 2013
Location: Tucson, AZ, USA
Distribution: CentOS 7.5
Posts: 1,986

Rep: Reputation: 624Reputation: 624Reputation: 624Reputation: 624Reputation: 624Reputation: 624
May we see the exact failure message you received, please?
Is there any help in /var/log/audit.log?
If /var/log/audit a directory? What's in it? Why did you opt to not allow "others" to access it (755 instead of 750)

Have you opened a ticket with RH support?
 
1 members found this post helpful.
Old 08-10-2018, 01:23 PM   #3
dj_thrive
LQ Newbie
 
Registered: Dec 2016
Location: Huntvsille, AL
Distribution: RedHat 6
Posts: 27

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by scasey View Post
May we see the exact failure message you received, please?
Is there any help in /var/log/audit.log?
If /var/log/audit a directory? What's in it? Why did you opt to not allow "others" to access it (755 instead of 750)

Have you opened a ticket with RH support?
Thanks for your response.

The exact failure message is simply
Code:
[FAILED]
in red letters.

/var/log/audit/audit.log is blank

Yes, /var/log/audit is a directory and contains audit.log created in July, audit.log.3 created in 2014, and an empty directory called backup_logs. I simply used 750 based on a help article I saw. If you think 755 is better for troubleshooting this issue, I can try that.

I have not yet, I need to renew my support again.

Last edited by dj_thrive; 08-16-2018 at 11:56 AM. Reason: Typo (Misspelling)
 
Old 08-10-2018, 01:35 PM   #4
scasey
Senior Member
 
Registered: Feb 2013
Location: Tucson, AZ, USA
Distribution: CentOS 7.5
Posts: 1,986

Rep: Reputation: 624Reputation: 624Reputation: 624Reputation: 624Reputation: 624Reputation: 624
I don't know if 755 is better or not...kind of a "grasping at straws" thing. Most of the directories in /var/log on my CentOS 7.5 system are 700 - a couple are 755.

Who owns the audit.log?
What's printing the failure message? [My be in /etc/initd.d/auditd]
Try to start, then tail the most recently changed log in /var/log and/or /var/log/audit

...renew your subscription
 
Old 08-10-2018, 02:01 PM   #5
TB0ne
LQ Guru
 
Registered: Jul 2003
Location: Birmingham, Alabama
Distribution: SuSE, RedHat, Slack,CentOS
Posts: 20,706

Rep: Reputation: 5090Reputation: 5090Reputation: 5090Reputation: 5090Reputation: 5090Reputation: 5090Reputation: 5090Reputation: 5090Reputation: 5090Reputation: 5090Reputation: 5090
Quote:
Originally Posted by dj_thrive View Post
Thanks for your response.

The exact failure message is simply
Code:
[FAILED]
in red letters.

/var/log/audit/audit.log is blank

Yes, /var/log/audit is a directory and contains audit.log created in July, audit.log.3 created in 2014, and an empty directoy called backup_logs. I simply used 750 based on a help article I saw. If you think 755 is better for troubleshooting this issue, I can try that.
Run "sudo /sbin/auditd -f" (see the man pages), to get auditd to run in the foreground...all messages will then come through on the terminal and you can look. With only "FAILED"...what do you think we'll be able to tell you?
Quote:
I have not yet, I need to renew my support again.
Yes.
 
1 members found this post helpful.
Old 08-16-2018, 11:55 AM   #6
dj_thrive
LQ Newbie
 
Registered: Dec 2016
Location: Huntvsille, AL
Distribution: RedHat 6
Posts: 27

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by TB0ne View Post
Run "sudo /sbin/auditd -f" (see the man pages), to get auditd to run in the foreground...all messages will then come through on the terminal and you can look. With only "FAILED"...what do you think we'll be able to tell you?
Thank you, the command "sudo /sbin/auditd -f" told me a lot. It first notified me of an error in my auditd.conf file regarding the path to the audit.log file, which I've corrected. Now that command returns
Code:
config file /etc/audit/audit.conf opened for parsing
then has several lines indicating successful reading of my auditd.conf file, then a new error. My new error is
Code:
dispatch_parser called with: /sbin/audisp
unable to open /sbin/audsip (No such file or directory)
The audit daemon is exiting
I created the directory /sbin/audisp then ran "sudo /sbin/auditd -f" again, and it indicated that it expected /sbin/audsip to be a file, not a directory. So my new question is, what type of file or program is audisp, and how do I properly create or install it? Thanks for your time, and I am also contacting RedHat support as I've corrected my subscription issue.
 
Old 08-16-2018, 12:49 PM   #7
TB0ne
LQ Guru
 
Registered: Jul 2003
Location: Birmingham, Alabama
Distribution: SuSE, RedHat, Slack,CentOS
Posts: 20,706

Rep: Reputation: 5090Reputation: 5090Reputation: 5090Reputation: 5090Reputation: 5090Reputation: 5090Reputation: 5090Reputation: 5090Reputation: 5090Reputation: 5090Reputation: 5090
Quote:
Originally Posted by dj_thrive View Post
Thank you, the command "sudo /sbin/auditd -f" told me a lot. It first notified me of an error in my auditd.conf file regarding the path to the audit.log file, which I've corrected. Now that command returns
Code:
config file /etc/audit/audit.conf opened for parsing
then has several lines indicating successful reading of my auditd.conf file, then a new error. My new error is
Code:
dispatch_parser called with: /sbin/audisp
unable to open /sbin/audsip (No such file or directory)
The audit daemon is exiting
I created the directory /sbin/audisp then ran "sudo /sbin/auditd -f" again, and it indicated that it expected /sbin/audsip to be a file, not a directory. So my new question is, what type of file or program is audisp, and how do I properly create or install it?
You look in the Red Hat knowledgebase, and install the entire audit system. audsip is a program, and part of that system, which is installed when you perform the "yum install audit" command on a registered RHEL system.
Quote:
Thanks for your time, and I am also contacting RedHat support as I've corrected my subscription issue.
Since you've corrected it, you should then be able to call Red Hat support, and they can walk you through installing audisp.
 
  


Reply

Tags
audit, auditd, auditing


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
auditd is stopped and won't start kcompton94 Linux - Server 1 04-17-2015 10:18 AM
auditd wont start jonfa Solaris / OpenSolaris 5 06-30-2014 12:16 PM
The auditd daemon stops logging after deleting audit.log until auditd is restarted Latitude Linux - Security 2 06-20-2013 04:10 PM
auditd fails to start on boot scruggsdl Linux - Server 3 11-24-2010 05:43 PM
Linux auditing in fedora, Selinux and auditd geburah Linux - Security 3 03-16-2006 05:46 AM

LinuxQuestions.org > Forums > Enterprise Linux Forums > Linux - Enterprise

All times are GMT -5. The time now is 03:12 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration