From mboxrd@z Thu Jan  1 00:00:00 1970
From: Steve Grubb <sgrubb@redhat.com>
Subject: Re: auditd start failure
Date: Fri, 16 Aug 2013 14:43:51 -0400
Message-ID: <5379838.d4n6s4eucp@x2>
References: <CAP6dAmcSXXM5e_1X6ViK8StchuowAa840E0E35vDuiAK6gjgtA@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <CAP6dAmcSXXM5e_1X6ViK8StchuowAa840E0E35vDuiAK6gjgtA@mail.gmail.com>
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On Friday, August 16, 2013 11:38:32 AM zhu xiuming wrote:
> HI
> Suddently, my auditd can't start. I do not know why.
> I remember I changed some permission settings on /var/log/audit. However,
> even I change it back, the auditd cann't be started.
> 
> I looked at the audit.log. It only shows the daemon is closed successfully
> 
> I wonder whether there is other log file I should look.

Its writes failure messages to /var/log/messages.  I sometimes troubleshoot 
issues by starting the daemon by hand in the foreground mode so that 
everything is written to the screen. /sbin/auditd  -f 

-Steve