RHEL 9: auditd Service Stops and Compliance Logging Gaps

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Security audit logs stop updating, creating compliance and forensic visibility gaps.

Environment & Reproduction

Run `systemctl status auditd` and `auditctl -s` to check daemon and queue state.

Root Cause Analysis

Confirm `audit` package versions and rules files are intact after updates.

Quick Triage

Ensure unit dependencies and startup ordering are not overridden incorrectly.

Step-by-Step Diagnosis

Review `journalctl -u auditd -b` for backlog overflow, permission, or rules parse errors.

Solution – Primary Fix

Tune backlog/rate settings, validate rules with augenrules, and restart auditd.

Solution – Alternative Approaches

If forwarding audit logs, verify transport ports and `firewalld` policy.

Verification & Acceptance Criteria

SELinux enforcement complements auditd; investigate AVC spikes that overload logging.

Rollback Plan

Reboot and confirm audit events continue without dropped records.

Prevention & Hardening

Monitor audit queue depth and rotate logs before disk pressure occurs.

Related Errors & Cross-Refs

Restore previously validated audit rules if new policies cause parser failures.

Related tutorial: View the step-by-step tutorial for rhel-9.

View all rhel-9 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Use RHEL audit subsystem documentation and compliance profile guidance.