Revision history [back]

Writing my own answer to let you know what fixed it:

After reported a bug, I found out that problem is related to permissions of /var/log/audit.

rpm -qvl audit | grep var showed that permissions should be the following:

drwxr-x---    2 root    root                  0 Mar 14 12:24 /var/log/audit

Since that wasn't the case, I tried to adjust them manually: (as root) chmod 750 /var/log/audit/ and chroot root:root /var/log/audit/.

Interestingly this didn't fix the problem. I still got a

auditd[1079]: Unable to create /var/log/audit/audit.log (Permission denied)

I decided to reinstall the audit package by running dnf reinstall audit which finally solved my problem.

systemctl status auditd.service reports active (running) , and aureport delivers a nice summary.

Writing my own answer to let you know what fixed it:

After reported a bug, I found out that problem is related to permissions of /var/log/audit.

rpm -qvl audit | grep var showed that permissions should be the following:

drwxr-x---    2 root    root                  0 Mar 14 12:24 /var/log/audit

Since that wasn't the case, I tried to adjust them manually: (as root) chmod 750 /var/log/audit/ and chroot root:root /var/log/audit/.

Interestingly this didn't fix the problem. I still got a

auditd[1079]: Unable to create /var/log/audit/audit.log (Permission denied)

I decided to reinstall the audit package by running dnf reinstall audit which finally solved my problem.

Now, systemctl status auditd.service reports active (running) , and aureport delivers a nice summary.