Red Hat Bugzilla – Bug 1275746
auditd.service failed. (Could not open dir /var/log/audit)
Last modified: 2015-10-27 12:42:06 EDT
systemctl status auditd.service
● auditd.service - Security Auditing Service
Loaded: loaded (/usr/lib/systemd/system/auditd.service; enabled; vendor preset: enabled)
Active: failed (Result: exit-code) since mar 2015-10-27 10:45:16 COT; 4min 55s ago
Main PID: 631 (code=exited, status=6)
oct 27 10:45:16 epoch systemd: Starting Security Auditing Service...
oct 27 10:45:16 epoch auditctl: No rules
oct 27 10:45:16 epoch systemd: Started Security Auditing Service.
oct 27 10:45:16 epoch auditd: Could not open dir /var/log/audit (No such file or directory)
oct 27 10:45:16 epoch auditd: The audit daemon is exiting.
oct 27 10:45:16 epoch systemd: auditd.service: main process exited, code=exited, status=6/NOTCONFIGURED
oct 27 10:45:16 epoch systemd: Unit auditd.service entered failed state.
oct 27 10:45:16 epoch systemd: auditd.service failed.
I already tried restarting with SELinux in permissive mode, but I get the same message.
By chance is this a first boot? Which audit package are you using? Is this a normal desktop system or something unusual like an atomic host? Offhand it sounds like bug 1097314.
Nope, is been like a month with this install.
Fedora 22 netinstall (Cinnamon desktop)
# rpm -qf /var/log/audit/
dnf/rpm should have made the directory on install assuming that its a real disk and not a tmpfs mount point.
Not sure what failed. You can just do a mkdir /var/log/audit/ to get the problem fixed. But I'm not sure that this is an audit problem.
Oh right, I reinstalled audit, and rebooted, works fine now, I wonder what failed, I'm pretty sure that is not audit, so I prefer to close this report, and be aware if something is deleting /var/log/audit or something.