我正在尝试在centos docker容器中配置rsyslog客户端,我注意到下面的错误。由于审计失败,看起来rsyslogd正在退出。
知道如何让rsyslog服务在centos docker容器内工作吗?
尝试了这个suggestion,但没有运气。
May 16 09:49:35 ad5de951dcd4 auditd[312]: Started dispatcher: /sbin/audispd pid: 316
May 16 09:49:35 ad5de951dcd4 auditd[312]: Unable to set initial audit startup state to 'enable', exiting
May 16 09:49:35 ad5de951dcd4 auditd[312]: The audit daemon is exiting.
May 16 09:49:35 ad5de951dcd4 systemd: auditd.service: main process exited, code=exited, status=1/FAILURE
May 16 09:49:35 ad5de951dcd4 audispd: syslog plugin initialized
May 16 09:49:35 ad5de951dcd4 audispd: audispd initialized with q_depth=150 and 1 active plugins
May 16 09:49:35 ad5de951dcd4 augenrules: /sbin/augenrules: No change
May 16 09:49:35 ad5de951dcd4 auditctl: The audit system is disabled
May 16 09:49:35 ad5de951dcd4 systemd: Failed to start Security Auditing Service.
May 16 09:49:35 ad5de951dcd4 systemd: Unit auditd.service entered failed state.
May 16 09:49:35 ad5de951dcd4 systemd: auditd.service failed.
May 16 09:49:53 ad5de951dcd4 systemd: Starting Security Auditing Service...
May 16 09:49:53 ad5de951dcd4 auditd[330]: Started dispatcher: /sbin/audispd pid: 333
May 16 09:49:53 ad5de951dcd4 auditd[330]: Unable to set initial audit startup state to 'enable', exiting
May 16 09:49:53 ad5de951dcd4 auditd[330]: The audit daemon is exiting.
May 16 09:49:53 ad5de951dcd4 systemd: auditd.service: main process exited, code=exited, status=1/FAILURE
May 16 09:49:53 ad5de951dcd4 audispd: syslog plugin initialized
May 16 09:49:53 ad5de951dcd4 audispd: audispd initialized with q_depth=150 and 1 active plugins
May 16 09:49:53 ad5de951dcd4 augenrules: /sbin/augenrules: No change
May 16 09:49:53 ad5de951dcd4 auditctl: The audit system is disabled
May 16 09:49:53 ad5de951dcd4 systemd: Failed to start Security Auditing Service.
May 16 09:49:53 ad5de951dcd4 systemd: Unit auditd.service entered failed state.
May 16 09:49:53 ad5de951dcd4 systemd: auditd.service failed.
May 16 10:09:57 ad5de951dcd4 systemd: Reloading.
May 16 10:10:02 ad5de951dcd4 systemd: Reloading.
May 16 10:10:10 ad5de951dcd4 rsyslogd: [origin software="rsyslogd" swVersion="7.4.7" x-pid="421" x-info="http://www.rsyslog.com"] exiting on signal 2.
答案 0 :(得分:0)
很抱歉,这并没有直接解决rsyslog问题,但会为您提供调查途径。
auditd目前在docker中没有工作(我遇到了类似的问题),请看这个帖子:
https://www.redhat.com/archives/linux-audit/2016-February/msg00011.html
因此,如果auditd对您的使用并不重要,您应该找到一种方法在rsyslog中禁用它。