# auditd.service fails on RPI3

Hi folks,

I need your help. I got myself a Raspberry Pi 3 and installed Fedora 24 on it , first Gnome, then LXDE. Both flavours worked in general (though Gnome was too sluggish), but everytime the Security Auditing Service auditd failed to start on boot. And also after booting, it was impossible to start via systemctl to get it running.

First of all I ran a dnf update as well as rpi-update, hoping that it would help, but it did not. Then, of course, I searched the internet in general and this forum specifically to find a solution to this problem:

• I found Florían's post which describes exactley the problem I am facing, but his solution of reinstalling audit did not work in my case.
• Interesting seems also this suggestion of Michael of shutting down the service, but I am hesitating being afraid of causing more harm than good.

As I am assuming that I am not the only one having these troubles and without the intention of kicking off a general discussion about whether F24 on a RPI is a good idea, I hope to receive a solution how to fix this problem.

My questions in particular are:

• Would you recommend to simply disable this service? I mean on scale form 0 to 10, how important is auditd?

• Or is there a way of getting auditd running? (Which would be the preferable option.)

I would be very thankful for any suggestions.

UPDATE (Fri Sep 9 14:30:00 2016)

Owing to probinson's post below, I gathered some more information on RPI kernel compilation and it seems that disabling the service is the better option according to these two sources:

It probably is intended, auditing support is a seriously huge amount of code (compared to some other features) that would likely provide absolutely zero benefit for a majority of users, and also can't be built as a loadable module. (Ferroin commented on 18 Mar)

Yes, it's disabled deliberately. Expensive settings with little benefit to the majority of users are not enabled on the Pi. CONFIG_AUDIT is not clearly a good thing

https://lwn.net/Articles/600568/

https://lwn.net/Articles/600578/

If you want it enabled you will need to provide justification including measures of cpu and memory usage with and without it. (popcornmix commented on 18 Mar)

edit retag close merge delete

Sort by » oldest newest most voted

The solution is, I disabled auditd by entering following command:

dnf disable auditd


Everything's fine now.

more

Your kernel doesn't have the required options compiled in. You'll either need to fix that or disable the service.

more