HI

Suddently, my auditd can't start. I do not know why.

I remember I changed some permission settings on /var/log/audit. However, even I change it back, the auditd cann't be started.

I looked at the audit.log. It only shows the daemon is closed successfully

I wonder whether there is other log file I should look.

Normally, it will print out the failure reason : wrong audit rules but this time, only

"Failed".

thanks a lot