0

I am getting an error related to the audit daemon in /var/log/syslog

Feb  6 23:57:02 svc auditd[3897]: Error setting audit daemon pid (Invalid argument)
Feb  6 23:57:02 svc kernel: [ 7546.027420] audit: type=1131 audit(1517986622.815:653): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=auditd comm="systemd" exe="/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Feb  6 23:57:13 svc auditd[6145]: Started dispatcher: /sbin/audispd pid: 6148
Feb  6 23:57:13 svc auditd[6145]: Init complete, auditd 2.7.7 listening for events (startup state enable)
Feb  6 23:57:13 svc auditd[6145]: dispatcher 6148 reaped
root@svc:/var/log#

This began occuring after updating from 17.04 to 17.10. /sbin/auditd appears to be running as root when I check via ps aux | grep audit...

root        39  0.0  0.0      0     0 ?        S    21:51   0:00 [kauditd]
root      3897  0.0  0.0 101668  1940 ?        S<sl 23:53   0:00 /sbin/auditd
root      4398  0.0  0.0  14352   972 pts/0    S+   23:54   0:00 grep --color=auto audit

And it's permissions are for root in /var/run

-rw-r--r--  1 root     root        5 Feb  6 23:53 auditd.pid

Not sure what else to check. Kernal is 4.13.0-16-generic.

Edit: It won't let me tag this as 17.10 cause I don't have enough rep.

Gerald Schneider
  • 23,274
  • 8
  • 57
  • 89
cnizzardini
  • 153
  • 1
  • 2
  • 13
  • If you didn't modify the files belonging to the auditd package yourself I'd try to reinstall the package. Maybe purge the installed package first to make sure all superfluity files are gone. – Gerald Schneider Feb 07 '18 at 07:35
  • I tried dpkg-reconfigure, was hoping to not have to do a reinstall. There should be a logical non-reinstall solution here. – cnizzardini Feb 07 '18 at 17:32

0 Answers0