[Arm-dev] Security auditing service

I had to reboot a server this morning.  I was working on one box and 
bumped things I should not have...

Then I noticed my name server was not coming up real fast like normal.  
So I get on the console and notice it is waiting for something to 
start.  It waited 3 min before giving up and getting everything else 
going.  So after it was up, I ssh in and checked the messages and found:

Dec 31 19:00:29 onlo systemd: Starting Security Auditing Service...
Dec 31 19:00:29 onlo auditd[499]: Started dispatcher: /sbin/audispd pid: 501
Dec 31 19:00:29 onlo audispd: No plugins found, exiting
Dec 31 19:01:59 onlo systemd: auditd.service start operation timed out. 
Terminat
ing.
Dec 31 19:03:30 onlo systemd: auditd.service stop-final-sigterm timed 
out. Killi
ng.
Dec 31 19:03:30 onlo systemd: auditd.service: control process exited, 
code=kille
d status=9
Dec 31 19:03:30 onlo systemd: Failed to start Security Auditing Service.
Dec 31 19:03:30 onlo systemd: Unit auditd.service entered failed state.
Dec 31 19:03:30 onlo systemd: auditd.service failed.


Ignore the timestamp.  This occurs before the network is up and chrony 
has not set the time.  Cubies do not have a battery RTC.

But I believe this is recent.  I had gone a LONG time without updating 
and applied some 180 rpms updates (in careful batches).  So this MAY be 
something new.


systemctl -l status auditd

Shows

● auditd.service - Security Auditing Service
    Loaded: loaded (/usr/lib/systemd/system/auditd.service; enabled; 
vendor prese
t: enabled)
    Active: failed (Result: signal) since Wed 1969-12-31 19:03:30 EST; 
48 years 7
  months ago
      Docs: man:auditd(8)
            https://github.com/linux-audit/audit-documentation
   Process: 498 ExecStart=/sbin/auditd (code=killed, signal=KILL)

Dec 31 19:00:29 onlo.htt-consult.com systemd[1]: Starting Security 
Auditing Serv
ice...
Dec 31 19:00:29 onlo.htt-consult.com auditd[499]: Started dispatcher: 
/sbin/audi
spd pid: 501
Dec 31 19:01:59 onlo.htt-consult.com systemd[1]: auditd.service start 
operation
timed out. Terminating.
Dec 31 19:03:30 onlo.htt-consult.com systemd[1]: auditd.service 
stop-final-sigte
rm timed out. Killing.
Dec 31 19:03:30 onlo.htt-consult.com systemd[1]: auditd.service: control 
process
  exited, code=killed status=9
Dec 31 19:03:30 onlo.htt-consult.com systemd[1]: Failed to start 
Security Auditi
ng Service.
Dec 31 19:03:30 onlo.htt-consult.com systemd[1]: Unit auditd.service 
entered fai
led state.
Dec 31 19:03:30 onlo.htt-consult.com systemd[1]: auditd.service failed.

So what may be going on?

My web server, medon.htt-consult.com is practically identical and is not 
exhibiting this behavior.

Dec 31 19:00:30 medon auditd[499]: Started dispatcher: /sbin/audispd 
pid: 501
Dec 31 19:00:30 medon auditd[499]: Init complete, auditd 2.8.1 listening 
for events (startup state enable)