What user are you running this as? Also, have you tried using: /etc/init.d/auditd start Thanks, Pat -- Patrick Synor Web Hosting Engineer RouteOne 31500 Northwestern Highway Suite 200 Farmington Hills, MI 48334 (248)862-7158 *From:* linux-audit-bounces(a)redhat.com [mailto: linux-audit-bounces(a)redhat.com] *On Behalf Of *zhu xiuming *Sent:* Monday, June 24, 2013 7:05 PM *To:* Linux-audit(a)redhat.com *Subject:* "Missing SERVICE_URI environment variable" at restart auditd HI I tried to start auditd on Redhat (kernel 2.6.18-164.el5) and I failed. The command is service auditd restart It complains Missing SERVICE_URI environment variable I wonder what is wrong? thanks a lot CONFIDENTIALITY NOTE: This message and any attachments are confidential, may contain information that is privileged and is intended only for the use of the addressee. If you are not the intended recipient or an authorized representative of the intended recipient, you are hereby notified that any dissemination of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by e-mail and delete the message and any attachments from your system. This message is not meant to constitute an electronic signature or evidence intent to contract electronically.