I have a RH 5 system that I setup auditd on. It works fine. I then cloned the RH 5 system using dd and on the new system auditd will not start. I don't see anything obvious that would cause this. Here is the output of auditd -f: Config file /etc/audit/auditd.conf opened for parsing log_file_parser called with: /var/log/audit/audit.log log_format_parser called with: RAW log_group_parser called with: root priority_boost_parser called with: 4 flush_parser called with: INCREMENTAL freq_parser called with: 20 num_logs_parser called with: 99 qos_parser called with: lossy dispatch_parser called with: /sbin/audispd name_format_parser called with: user name_parser called with: lb.example.com max_log_size_parser called with: 100 max_log_size_action_parser called with: ROTATE space_left_parser called with: 500 space_action_parser called with: email action_mail_acct_parser called with: john.smith(a)example.com The audit daemon is exiting.