From mboxrd@z Thu Jan  1 00:00:00 1970
From: audit@mm.st
Subject: Auditd Fails to start
Date: Tue, 04 Dec 2012 08:39:57 -0700
Message-ID: <1354635597.16609.140661161745173.1014D64A@webmail.messagingengine.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
Received: from mx1.redhat.com (ext-mx16.extmail.prod.ext.phx2.redhat.com
	[10.5.110.21])
	by int-mx11.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP
	id qB4GSlpa012757
	for <linux-audit@redhat.com>; Tue, 4 Dec 2012 11:28:49 -0500
Received: from out4-smtp.messagingengine.com (out4-smtp.messagingengine.com
	[66.111.4.28])
	by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id qB4FdwtL002115
	for <linux-audit@redhat.com>; Tue, 4 Dec 2012 10:39:59 -0500
Received: from compute1.internal (compute1.nyi.mail.srv.osa [10.202.2.41])
	by gateway1.nyi.mail.srv.osa (Postfix) with ESMTP id 0868420A98
	for <linux-audit@redhat.com>; Tue,  4 Dec 2012 10:39:58 -0500 (EST)
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

I have a RH 5 system that I setup auditd on.  It works fine.  I then
cloned the RH 5 system using dd and on the new system auditd will not
start.  I don't see anything obvious that would cause this.  Here is the
output of auditd -f:

Config file /etc/audit/auditd.conf opened for parsing
log_file_parser called with: /var/log/audit/audit.log
log_format_parser called with: RAW
log_group_parser called with: root
priority_boost_parser called with: 4
flush_parser called with: INCREMENTAL
freq_parser called with: 20
num_logs_parser called with: 99
qos_parser called with: lossy
dispatch_parser called with: /sbin/audispd
name_format_parser called with: user
name_parser called with: lb.example.com
max_log_size_parser called with: 100
max_log_size_action_parser called with: ROTATE
space_left_parser called with: 500
space_action_parser called with: email
action_mail_acct_parser called with: john.smith@example.com
The audit daemon is exiting.