Uploaded image for project: 'Red Hat Enterprise Linux AI'
  1. Red Hat Enterprise Linux AI
  2. RHELAI-2734

auditd failed to start after z-stream update

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Undefined Undefined
    • None
    • rhelai-1.3.1
    • None
    • None
    • False
    • Hide

      None

      Show
      None
    • False

      After upgrading (z-stream update) an Azure instance (Standard_ND96asr_v4) from 1.3 to 1.3.1, the auditd service fails to start.

      When logging into the machine, an error message appears on the screen:

      $ ssh -i <SSH_KEY> <SSH_USER>@<MACHINE_IP>
      Register this system with Red Hat Insights: insights-client --register
      Create an account or view all your systems at https://red.ht/insights-dashboard
      Last login: Tue Dec 17 11:51:23 2024 from xxx.xxx.xxx.xxx
      [systemd]
      Failed Units: 1
        auditd.service 
      [root@4l8g9o5f ~]# systemctl status auditd.service
      × auditd.service - Security Auditing Service
           Loaded: loaded (/usr/lib/systemd/system/auditd.service; enabled; preset: enabled)
           Active: failed (Result: exit-code) since Tue 2024-12-17 12:24:27 UTC; 55min ago
             Docs: man:auditd(8)
                   https://github.com/linux-audit/audit-documentation
          Process: 2265 ExecStart=/sbin/auditd (code=exited, status=6)
              CPU: 10msDec 17 12:24:27 4l8g9o5f systemd[1]: auditd.service: Scheduled restart job, restart counter is at 5.
      Dec 17 12:24:27 4l8g9o5f systemd[1]: Stopped Security Auditing Service.
      Dec 17 12:24:27 4l8g9o5f systemd[1]: auditd.service: Start request repeated too quickly.
      Dec 17 12:24:27 4l8g9o5f systemd[1]: auditd.service: Failed with result 'exit-code'.
      Dec 17 12:24:27 4l8g9o5f systemd[1]: Failed to start Security Auditing Service. 
      [root@4l8g9o5f ~]# journalctl -u auditd.service
      Dec 17 12:24:25 4l8g9o5f systemd[1]: Starting Security Auditing Service...
      Dec 17 12:24:25 4l8g9o5f auditd[2011]: Could not open dir /var/log/audit (No such file or directory)
      Dec 17 12:24:25 4l8g9o5f auditd[2011]: The audit daemon is exiting.
      Dec 17 12:24:25 4l8g9o5f systemd[1]: auditd.service: Control process exited, code=exited, status=6/NOTCONFIGURED
      Dec 17 12:24:25 4l8g9o5f systemd[1]: auditd.service: Failed with result 'exit-code'.
      Dec 17 12:24:25 4l8g9o5f systemd[1]: Failed to start Security Auditing Service.
      Dec 17 12:24:25 4l8g9o5f systemd[1]: auditd.service: Scheduled restart job, restart counter is at 1.
      Dec 17 12:24:25 4l8g9o5f systemd[1]: Stopped Security Auditing Service.
      Dec 17 12:24:25 4l8g9o5f systemd[1]: Starting Security Auditing Service...
      Dec 17 12:24:25 4l8g9o5f auditd[2045]: Could not open dir /var/log/audit (No such file or directory)
      Dec 17 12:24:25 4l8g9o5f auditd[2045]: The audit daemon is exiting.
      Dec 17 12:24:25 4l8g9o5f systemd[1]: auditd.service: Control process exited, code=exited, status=6/NOTCONFIGURED
      Dec 17 12:24:25 4l8g9o5f systemd[1]: auditd.service: Failed with result 'exit-code'.
      Dec 17 12:24:25 4l8g9o5f systemd[1]: Failed to start Security Auditing Service.
      Dec 17 12:24:26 4l8g9o5f systemd[1]: auditd.service: Scheduled restart job, restart counter is at 2.
      Dec 17 12:24:26 4l8g9o5f systemd[1]: Stopped Security Auditing Service.
      Dec 17 12:24:26 4l8g9o5f systemd[1]: Starting Security Auditing Service...
      Dec 17 12:24:26 4l8g9o5f auditd[2195]: Could not open dir /var/log/audit (No such file or directory)
      Dec 17 12:24:26 4l8g9o5f auditd[2195]: The audit daemon is exiting.
      Dec 17 12:24:26 4l8g9o5f systemd[1]: auditd.service: Control process exited, code=exited, status=6/NOTCONFIGURED
      Dec 17 12:24:26 4l8g9o5f systemd[1]: auditd.service: Failed with result 'exit-code'.
      Dec 17 12:24:26 4l8g9o5f systemd[1]: Failed to start Security Auditing Service.
      Dec 17 12:24:26 4l8g9o5f systemd[1]: auditd.service: Scheduled restart job, restart counter is at 3.
      Dec 17 12:24:26 4l8g9o5f systemd[1]: Stopped Security Auditing Service.
      Dec 17 12:24:26 4l8g9o5f systemd[1]: Starting Security Auditing Service...
      Dec 17 12:24:26 4l8g9o5f auditd[2259]: Could not open dir /var/log/audit (No such file or directory)
      Dec 17 12:24:26 4l8g9o5f auditd[2259]: The audit daemon is exiting.
      Dec 17 12:24:26 4l8g9o5f systemd[1]: auditd.service: Control process exited, code=exited, status=6/NOTCONFIGURED
      Dec 17 12:24:26 4l8g9o5f systemd[1]: auditd.service: Failed with result 'exit-code'.
      Dec 17 12:24:26 4l8g9o5f systemd[1]: Failed to start Security Auditing Service.
      Dec 17 12:24:26 4l8g9o5f systemd[1]: auditd.service: Scheduled restart job, restart counter is at 4.
      Dec 17 12:24:26 4l8g9o5f systemd[1]: Stopped Security Auditing Service.
      Dec 17 12:24:26 4l8g9o5f systemd[1]: Starting Security Auditing Service...
      Dec 17 12:24:26 4l8g9o5f auditd[2265]: Could not open dir /var/log/audit (No such file or directory)
      Dec 17 12:24:26 4l8g9o5f auditd[2265]: The audit daemon is exiting.
      Dec 17 12:24:26 4l8g9o5f systemd[1]: auditd.service: Control process exited, code=exited, status=6/NOTCONFIGURED
      Dec 17 12:24:26 4l8g9o5f systemd[1]: auditd.service: Failed with result 'exit-code'.
      Dec 17 12:24:26 4l8g9o5f systemd[1]: Failed to start Security Auditing Service.
      Dec 17 12:24:27 4l8g9o5f systemd[1]: auditd.service: Scheduled restart job, restart counter is at 5.
      Dec 17 12:24:27 4l8g9o5f systemd[1]: Stopped Security Auditing Service.
      Dec 17 12:24:27 4l8g9o5f systemd[1]: auditd.service: Start request repeated too quickly.
      Dec 17 12:24:27 4l8g9o5f systemd[1]: auditd.service: Failed with result 'exit-code'.
      Dec 17 12:24:27 4l8g9o5f systemd[1]: Failed to start Security Auditing Service. 

      Bootc status with both images:

      [azureuser@4l8g9o5f ~]$ sudo bootc status
      apiVersion: org.containers.bootc/v1alpha1
      kind: BootcHost
      metadata:
        name: host
      spec:
        image:
          image: registry.stage.redhat.io/rhelai1/bootc-azure-nvidia-rhel9:1.3
          transport: registry
        bootOrder: default
      status:
        staged: null
        booted:
          image:
            image:
              image: registry.stage.redhat.io/rhelai1/bootc-azure-nvidia-rhel9:1.3
              transport: registry
            version: 9.20241019.0
            timestamp: null
            imageDigest: sha256:2956f9d8c7428919d19a50da8915f627ec897a0846e4c4bcac79e4ad6b75da59
          cachedUpdate:
            image:
              image: registry.stage.redhat.io/rhelai1/bootc-azure-nvidia-rhel9:1.3
              transport: registry
            version: 9.20241104.0
            timestamp: null
            imageDigest: sha256:fea116fb5e9a9e19fdcba1a52d72d502d422cca109b4ead40f5f006854976469
          incompatible: false
          pinned: false
          store: ostreeContainer
          ostree:
            checksum: cb4350d3b89f5ba340a9caa20d1865b66fd9a0979c41230b303b072712cef36a
            deploySerial: 0
        rollback: null
        rollbackQueued: false
        type: bootcHost 

              Unassigned Unassigned
              aopincar Ariel Opincaru
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated: