systemctl status auditd.service ● auditd.service - Security Auditing Service Loaded: loaded (/usr/lib/systemd/system/auditd.service; enabled; vendor preset: enabled) Active: failed (Result: exit-code) since mar 2015-10-27 10:45:16 COT; 4min 55s ago Main PID: 631 (code=exited, status=6) oct 27 10:45:16 epoch systemd[1]: Starting Security Auditing Service... oct 27 10:45:16 epoch auditctl[632]: No rules oct 27 10:45:16 epoch systemd[1]: Started Security Auditing Service. oct 27 10:45:16 epoch auditd[631]: Could not open dir /var/log/audit (No such file or directory) oct 27 10:45:16 epoch auditd[631]: The audit daemon is exiting. oct 27 10:45:16 epoch systemd[1]: auditd.service: main process exited, code=exited, status=6/NOTCONFIGURED oct 27 10:45:16 epoch systemd[1]: Unit auditd.service entered failed state. oct 27 10:45:16 epoch systemd[1]: auditd.service failed. I already tried restarting with SELinux in permissive mode, but I get the same message.
By chance is this a first boot? Which audit package are you using? Is this a normal desktop system or something unusual like an atomic host? Offhand it sounds like bug 1097314.
Nope, is been like a month with this install. audit 2.4.4-1.fc22 Fedora 22 netinstall (Cinnamon desktop)
# rpm -qf /var/log/audit/ audit-2.4.4-1.x86_64 dnf/rpm should have made the directory on install assuming that its a real disk and not a tmpfs mount point. https://fedorahosted.org/audit/browser/trunk/audit.spec#L271 Not sure what failed. You can just do a mkdir /var/log/audit/ to get the problem fixed. But I'm not sure that this is an audit problem.
Oh right, I reinstalled audit, and rebooted, works fine now, I wonder what failed, I'm pretty sure that is not audit, so I prefer to close this report, and be aware if something is deleting /var/log/audit or something.