我在CentOS 5.8最后
我最近yum install audit通过yum install audit但我无法启动它。
我编辑了configuration文件，给出了一个详细的错误输出，它是在启动时收到的错误，这是输出：
# service auditd start Starting auditd: Config file /etc/audit/auditd.conf opened for parsing log_file_parser called with: /var/log/audit/audit.log log_format_parser called with: RAW log_group_parser called with: root priority_boost_parser called with: 4 flush_parser called with: INCREMENTAL freq_parser called with: 20 num_logs_parser called with: 4 qos_parser called with: lossy dispatch_parser called with: /sbin/audispd name_format_parser called with: NONE max_log_size_parser called with: 5 max_log_size_action_parser called with: ROTATE space_left_parser called with: 75 space_action_parser called with: SYSLOG action_mail_acct_parser called with: root admin_space_left_parser called with: 50 admin_space_left_action_parser called with: SUSPEND disk_full_action_parser called with: SUSPEND disk_error_action_parser called with: SUSPEND tcp_listen_queue_parser called with: 5 tcp_max_per_addr_parser called with: 1 tcp_client_max_idle_parser called with: 0 enable_krb5_parser called with: no GSSAPI support is not enabled, ignoring value at line 30 krb5_principal_parser called with: auditd GSSAPI support is not enabled, ignoring value at line 31 Started dispatcher: /sbin/audispd pid: 3097 type=DAEMON_START msg=audit(1339336882.187:9205): auditd start, ver=1.8 format=raw kernel=2.6.32-042stab056.8 auid=4294967295 pid=3095 res=success config_manager init complete Error setting audit daemon pid (Connection refused) type=DAEMON_ABORT msg=audit(1339336882.189:9206): auditd error halt, auid=4294967295 pid=3095 res=failed Unable to set audit pid, exiting The audit daemon is exiting. Error setting audit daemon pid (Connection refused) [FAILED]
我可以在网上find的唯一信息是，这可能是由于SELinux，但SELinux给我自己的问题。 无论我做什么，它似乎被禁用（我想启用它）。 configuration设置为enforced ，并且服务器已经重启了很多次，但是sestatus仍然返回SELinux status: disabled 。
任何人都可以照亮这个问题吗？
编辑：我不知道是否相关，但我注意到以下消息出现在我的/var/log/messages
Jun 10 16:25:22 s1 iscsid: iSCSI logger with pid=2056 started! Jun 10 16:25:22 s1 iscsid: Missing or Invalid version from /sys/module/scsi_transport_iscsi/version. Make sure a up to date scsi_transport_iscsi module is loaded and a up todate version of iscsid is running. Exiting...
我试图自己启动iSCSI守护进程（我不知道它是什么，我是一个Linux新手），我得到以下错误：
Starting iSCSI daemon: FATAL: Could not load /lib/modules/2.6.32-042stab056.8/modules.dep: No such file or directory FATAL: Could not load /lib/modules/2.6.32-042stab056.8/modules.dep: No such file or directory FATAL: Could not load /lib/modules/2.6.32-042stab056.8/modules.dep: No such file or directory FATAL: Could not load /lib/modules/2.6.32-042stab056.8/modules.dep: No such file or directory FATAL: Could not load /lib/modules/2.6.32-042stab056.8/modules.dep: No such file or directory [FAILED]
如果我去/lib/modules/我注意到目录存在，但是完全是空的。
看来我正在使用的内核2.6.32-042stab056.8 SMP与OpenVZ打包在一起的2.6.32-042stab056.8 SMP不支持auditd。
Error setting audit daemon pid (Connection refused)
看起来像是无法写入pid文件（通常在/ var / run）。 确保守护进程有权写入该目录来写入pid文件。