When I'm trying to start auditctl in my terminal (vds container ubuntu 14.04) I have the message:
The audit system is disabled
in audit.log:
type=DAEMON_START msg=audit(1453274392.823:9236): auditd start, ver=2.3.2 format=raw kernel=2.6.32 auid=0 pid=2367 res=success
type=DAEMON_ABORT msg=audit(1453274392.825:9237): auditd error halt, auid=0 pid=2367 res=failed
in syslog:
Jan 20 02:01:00 vm16590 auditd[3512]: Started dispatcher: /sbin/audispd pid: 3514
Jan 20 02:01:00 vm16590 audispd: priority_boost_parser called with: 4
Jan 20 02:01:00 vm16590 audispd: max_restarts_parser called with: 10
Jan 20 02:01:00 vm16590 audispd: No plugins found, exiting
Jan 20 02:01:00 vm16590 auditd[3512]: Unable to set initial audit startup state to 'enable', exiting
Jan 20 02:01:00 vm16590 auditd: Cannot daemonize (Success)
Jan 20 02:01:00 vm16590 auditd: The audit daemon is exiting.
Jan 20 02:01:00 vm16590 auditd[3512]: The audit daemon is exiting.
How can I start it?
UPDATE
If is true this is impossible to use audit inside a container.
