主页 / server / 问题 / 397344
Accepted
George Reith
Asked: 2012-06-11 06:10:35 +0800 CST

无法启动 auditd

  • 772

我在 CentOS 5.8 final

我最近安装了auditdviayum install audit但是我无法启动它。

我编辑了配置文件以提供启动时收到的错误的详细输出，这是输出：

# service auditd start
Starting auditd: Config file /etc/audit/auditd.conf opened for parsing
log_file_parser called with: /var/log/audit/audit.log
log_format_parser called with: RAW
log_group_parser called with: root
priority_boost_parser called with: 4
flush_parser called with: INCREMENTAL
freq_parser called with: 20
num_logs_parser called with: 4
qos_parser called with: lossy
dispatch_parser called with: /sbin/audispd
name_format_parser called with: NONE
max_log_size_parser called with: 5
max_log_size_action_parser called with: ROTATE
space_left_parser called with: 75
space_action_parser called with: SYSLOG
action_mail_acct_parser called with: root
admin_space_left_parser called with: 50
admin_space_left_action_parser called with: SUSPEND
disk_full_action_parser called with: SUSPEND
disk_error_action_parser called with: SUSPEND
tcp_listen_queue_parser called with: 5
tcp_max_per_addr_parser called with: 1
tcp_client_max_idle_parser called with: 0
enable_krb5_parser called with: no
GSSAPI support is not enabled, ignoring value at line 30
krb5_principal_parser called with: auditd
GSSAPI support is not enabled, ignoring value at line 31
Started dispatcher: /sbin/audispd pid: 3097
type=DAEMON_START msg=audit(1339336882.187:9205): auditd start, ver=1.8 format=raw kernel=2.6.32-042stab056.8 auid=4294967295 pid=3095 res=success
config_manager init complete
Error setting audit daemon pid (Connection refused)
type=DAEMON_ABORT msg=audit(1339336882.189:9206): auditd error halt, auid=4294967295 pid=3095 res=failed
Unable to set audit pid, exiting
The audit daemon is exiting.
Error setting audit daemon pid (Connection refused)
                                                           [FAILED]

我可以在网上找到的唯一信息是这可能是由于 SELinux，但是 SELinux 给我带来了它自己的问题。无论我做什么，它似乎都被禁用了（我想启用它）。配置设置为enforced并且服务器已重新启动多次但sestatus仍然返回SELinux status: disabled。

谁能阐明这个问题？

编辑：我不知道它是否相关，但我注意到以下消息出现在我的/var/log/messages

Jun 10 16:25:22 s1 iscsid: iSCSI logger with pid=2056 started!
Jun 10 16:25:22 s1 iscsid: Missing or Invalid version from /sys/module/scsi_transport_iscsi/version. Make sure a up to date scsi_transport_iscsi module is loaded and a up todate version of iscsid is running. Exiting...

我尝试自己启动 iSCSI 守护进程（我不知道它的作用；我是 Linux 新手），但出现以下错误：

Starting iSCSI daemon: FATAL: Could not load /lib/modules/2.6.32-042stab056.8/modules.dep: No such file or directory
FATAL: Could not load /lib/modules/2.6.32-042stab056.8/modules.dep: No such file or directory
FATAL: Could not load /lib/modules/2.6.32-042stab056.8/modules.dep: No such file or directory
FATAL: Could not load /lib/modules/2.6.32-042stab056.8/modules.dep: No such file or directory
FATAL: Could not load /lib/modules/2.6.32-042stab056.8/modules.dep: No such file or directory
                                                           [FAILED]

如果我去，/lib/modules/我注意到该目录存在但完全是空的。

linux centos audit selinux

2 个回答

  1. Best Answer

    看来我正在使用2.6.32-042stab056.8 SMP的与 OpenVZ 一起打包的内核不支持 auditd。

    • 6 
  2. Error setting audit daemon pid (Connection refused)

    看起来它无法写入 pid 文件（通常在 /var/run 中）。确保守护进程有权写入该目录以写入 pid 文件。

    • 1

相关问题