2

CentOS prints the following during boot

[ ***  ] A stop job is running for Security Auditing Service (9s / 1min 30s)

and then switches into the single user mode.

McLayn
  • 61
  • 1
  • 7
  • I had a problem and it wasn't googleable, so here is the problem and the solution for future generations – McLayn Aug 05 '21 at 16:10

1 Answers1

2

The problem was in /etc/audit/auditd.conf - see man 5 auditd.conf

In the case of not enough memory (for audit logs), it was set to switch the server into the single user mode:

space_left_action = SINGLE
admin_space_left_action = SINGLE

The fix was to tweak the values of space_left and admin_space_left or to revert the original values of:

space_left_action = SYSLOG
admin_space_left_action = SUSPEND
McLayn
  • 61
  • 1
  • 7