From: Steve Grubb <sgrubb@redhat.com>
To: linux-audit@redhat.com
Cc: Venkata Neehar Kurukunda <Venkata.Neehar.Kurukunda@ibm.com>
Subject: Re: "service auditd start" fails inside a container
Date: Thu, 19 Jul 2018 14:53:32 -0400 [thread overview]
Message-ID: <1969711.9VlKChbmdP@x2> (raw)
In-Reply-To: <OF981C10F9.791A6E5E-ON002582CF.00636F0E-002582CF.006466D4@notes.na.collabserv.com>
On Thursday, July 19, 2018 2:16:39 PM EDT Venkata Neehar Kurukunda wrote:
> Hi,
>
> I am writing this email to report an issue while using audit inside a
> docker container (with CentOS 7.5 as base layer). It installs fine, but,
> when I try to do service auditd start, it fails with the message"
> "Redirecting to /bin/systemctl start auditd.service Job for auditd.service
> failed because the control process exited with error code. See "systemctl
> status auditd.service" and "journalctl -xe" for details."
>
> The output of the command, systemctl status auditd.service, is:
> "
> ● auditd.service - Security Auditing Service
> Loaded: loaded (/usr/lib/systemd/system/auditd.service; enabled; vendor
> preset: enabled) Active: failed (Result: exit-code) since Thu 2018-07-19
> 18:12:50 UTC; 2min 8s ago Docs: man:auditd(8)
> https://github.com/linux-audit/audit-documentation
> Process: 12119 ExecStart=/sbin/auditd (code=exited, status=1/FAILURE)
> Jul 19 18:12:50 wanly1.fyre.ibm.com systemd[1]: Starting Security Auditing
> Service... Jul 19 18:12:50 wanly1.fyre.ibm.com auditd[12120]: Started
> dispatcher: /sbin/audispd pid: 12122 Jul 19 18:12:50 wanly1.fyre.ibm.com
> auditd[12120]: Error sending status request (Operation not permitted) Jul
> 19 18:12:50 wanly1.fyre.ibm.com auditd[12120]: Error sending enable
> request (Operation not permitted) Jul 19 18:12:50 wanly1.fyre.ibm.com
> systemd[1]: auditd.service: control process exited, code=exited status=1
> Jul 19 18:12:50 wanly1.fyre.ibm.com systemd[1]: Failed to start Security
> Auditing Service. Jul 19 18:12:50 wanly1.fyre.ibm.com systemd[1]: Unit
> auditd.service entered failed state. Jul 19 18:12:50 wanly1.fyre.ibm.com
> systemd[1]: auditd.service failed."
>
> Can someone please help me figure this issue out.
At the moment, auditd can be used inside a container only for aggregating
logs from other systems. It cannot be used to get events relevant to the
cotainer or the host OS. If you want to aggregate only, then set
local_events=no in auditd.conf.
Container support is still under development.
-Steve
--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
next prev parent reply other threads:[~2018-07-19 18:53 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-07-19 18:16 "service auditd start" fails inside a container Venkata Neehar Kurukunda
2018-07-19 18:53 ` Steve Grubb [this message]
-- strict thread matches above, loose matches on Subject: below --
2023-04-28 7:54 江杨
2023-04-28 18:48 ` Steve Grubb
2023-04-30 0:20 ` 江杨
2023-05-01 15:01 ` Daniel Walsh
2023-05-02 13:27 ` Richard Guy Briggs
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1969711.9VlKChbmdP@x2 \
--to=sgrubb@redhat.com \
--cc=Venkata.Neehar.Kurukunda@ibm.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox