Bug 1275746 - auditd.service failed. (Could not open dir /var/log/audit)
auditd.service failed. (Could not open dir /var/log/audit)
Status: CLOSED NOTABUG
Product: Fedora
Classification: Fedora
Component: audit (Show other bugs)
22
x86_64 Linux
unspecified Severity high
: ---
: ---
Assigned To: Steve Grubb
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2015-10-27 11:53 EDT by Neil
Modified: 2015-10-27 12:42 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-10-27 12:42:06 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Neil 2015-10-27 11:53:06 EDT
systemctl status auditd.service 
● auditd.service - Security Auditing Service
   Loaded: loaded (/usr/lib/systemd/system/auditd.service; enabled; vendor preset: enabled)
   Active: failed (Result: exit-code) since mar 2015-10-27 10:45:16 COT; 4min 55s ago
 Main PID: 631 (code=exited, status=6)

oct 27 10:45:16 epoch systemd[1]: Starting Security Auditing Service...
oct 27 10:45:16 epoch auditctl[632]: No rules
oct 27 10:45:16 epoch systemd[1]: Started Security Auditing Service.
oct 27 10:45:16 epoch auditd[631]: Could not open dir /var/log/audit (No such file or directory)
oct 27 10:45:16 epoch auditd[631]: The audit daemon is exiting.
oct 27 10:45:16 epoch systemd[1]: auditd.service: main process exited, code=exited, status=6/NOTCONFIGURED
oct 27 10:45:16 epoch systemd[1]: Unit auditd.service entered failed state.
oct 27 10:45:16 epoch systemd[1]: auditd.service failed.




I already tried restarting with SELinux in permissive mode, but I get the same message.
Comment 1 Steve Grubb 2015-10-27 11:59:33 EDT
By chance is this a first boot? Which audit package are you using? Is this a normal desktop system or something unusual like an atomic host? Offhand it sounds like bug 1097314.
Comment 2 Neil 2015-10-27 12:09:24 EDT
Nope, is been like a month with this install.

audit 2.4.4-1.fc22 
Fedora 22 netinstall (Cinnamon desktop)
Comment 3 Steve Grubb 2015-10-27 12:21:36 EDT
# rpm -qf /var/log/audit/
audit-2.4.4-1.x86_64

dnf/rpm should have made the directory on install assuming that its a real disk and not a tmpfs mount point.

https://fedorahosted.org/audit/browser/trunk/audit.spec#L271

Not sure what failed. You can just do a mkdir /var/log/audit/ to get the problem fixed. But I'm not sure that this is an audit problem.
Comment 4 Neil 2015-10-27 12:42:06 EDT
Oh right, I reinstalled audit, and rebooted, works fine now, I wonder what failed, I'm pretty sure that is not audit, so I prefer to close this report, and be aware if something is deleting /var/log/audit or something.

Note You need to log in before you can comment on or make changes to this bug.