Bug ID 981005
Summary auditd doesn't start (exits with status=6/NOTCONFIGURED)
Classification openSUSE
Product openSUSE Tumbleweed
Version Current
Hardware Other
OS openSUSE 13.2
Status NEW
Severity Major
Priority P5 - None
Component Security
Assignee tonyj@suse.com
Reporter suse-beta@cboltz.de
QA Contact qa-bugs@suse.de
Found By Beta-Customer
Blocker ---

auditd fails to start (both at boot and on manual start attemps).

# systemctl status auditd.service 
��� auditd.service - Security Auditing Service
   Loaded: loaded (/usr/lib/systemd/system/auditd.service; enabled; vendor
preset: enabled)
   Active: failed (Result: exit-code) since Sa 2016-05-21 12:43:55 CEST; 4min
14s ago
  Process: 8656 ExecStartPost=/sbin/augenrules --load (code=exited,
status=0/SUCCESS)
  Process: 8654 ExecStart=/sbin/auditd -n (code=exited, status=6)
 Main PID: 8654 (code=exited, status=6)

Mai 21 12:43:55 tux systemd[1]: Starting Security Auditing Service...
Mai 21 12:43:55 tux systemd[1]: auditd.service: Main process exited,
code=exited, status=6/NOTCONFIGURED
Mai 21 12:43:55 tux augenrules[8656]: /sbin/augenrules: No change
Mai 21 12:43:55 tux augenrules[8656]: No rules
Mai 21 12:43:55 tux systemd[1]: Failed to start Security Auditing Service.
Mai 21 12:43:55 tux systemd[1]: auditd.service: Unit entered failed state.
Mai 21 12:43:55 tux systemd[1]: auditd.service: Failed with result 'exit-code'.


I'm sure it worked in the past (I'm using the audit.log quite often during
AppArmor development), so this must be a regression in one of the last
tumbleweed updates.

IIRC I didn't do any changes in the audit config. Also, "rpm -V audit" doesn't
report any changes.


You are receiving this mail because: