auditd fails to start on FC6 system, newer kernels effect?

Gene Heskett gene.heskett at verizon.net
Sat Nov 17 09:31:17 UTC 2007


Greetings;

FC6 system, uptodate, kernel 2.6.24-rc3, but this has existed since I 
re-enabled selinux in permissive mode just to see what complained.

The manpage says to use the -f option for foreground troubleshooting, so here 
goes:

[root at coyote linux-2.6.24-rc3]# man auditd
[root at coyote linux-2.6.24-rc3]# which auditd
/sbin/auditd
[root at coyote linux-2.6.24-rc3]# auditd -f
Config file /etc/audit/auditd.conf opened for parsing
log_file_parser called with: /var/log/audit/audit.log
log_format_parser called with: RAW
priority_boost_parser called with: 3
flush_parser called with: INCREMENTAL
freq_parser called with: 20
num_logs_parser called with: 4
dispatch_parser called with: /sbin/audispd
qos_parser called with: lossy
max_log_size_parser called with: 5
max_log_size_action_parser called with: ROTATE
space_left_parser called with: 75
space_action_parser called with: SYSLOG
action_mail_acct_parser called with: root
admin_space_left_parser called with: 50
admin_space_left_action_parser called with: SUSPEND
disk_full_action_parser called with: SUSPEND
disk_error_action_parser called with: SUSPEND
Started dispatcher: /sbin/audispd pid: 7828
type=DAEMON_START msg=audit(1195291550.719:1106) auditd start, ver=1.4.2, 
format=raw, auid=4294967295 pid=7824 res=success, auditd pid=7824
config_manager init complete
Error setting audit daemon pid (Connection refused)
type=DAEMON_ABORT msg=audit(1195291550.720:1107) auditd error halt, 
auid=4294967295 pid=7824 res=failed, auditd pid=7824
Unable to set audit pid, exiting
The audit daemon is exiting.
Error setting audit daemon pid (Connection refused)
[root at coyote linux-2.6.24-rc3]#

Connection refused sounds as if something else isn't running that should be, 
but no direct clue, so what else needs to run too, before auditd?

-- 
Cheers, Gene
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
meeting, n.:
	An assembly of people coming together to decide what person or
	department not represented in the room must solve a problem.




More information about the fedora-selinux-list mailing list