In case anyone has as much trouble as I do following instructions, here is my /etc/systemd/system/auditd.service file excerpt, which enables the auditd to start a bit later, especially after disabling ipV6 in the kernel command options.  Just showing the changed part. I first copied the entire file from /usr/lib/systemd/system/auditd.service. HTH, LCB #cat /etc/systemd/system/auditd.service [Unit] Description=Security Auditing Service DefaultDependencies=no ## If auditd.conf has tcp_listen_port enabled, copy this file to ## /etc/systemd/system/auditd.service and add network-online.target ## to the next line so it waits for the network to start before launching. After=network-online.target local-fs.target systemd-tmpfiles-setup.service #Conflicts=shutdown.target #Before=sysinit.target shutdown.target Before=shutdown.target Conflicts=shutdown.target RefuseManualStop=yes ConditionKernelCommandLine=!audit=0 Documentation=man:auditd(8) https://github.com/linux-audit/audit-documentation ... -- Lenny Bruzenak MagitekLTD