Description

Auditd service failure on SSR after version upgrade.

The following error is seen after upgrading from version 6.1.12 to 6.2.9

ERROR: Auditd failed to start, system cannot process audit logs.

Symptoms

ERROR: "Could not open dir /var/log/audit" seen in the journal logs.

Solution

  • Open the Linux prompt as the root user and check the status of the auditd service.
    • systemctl status auditd.service
  • Go to the directory /var/log
    • cd /var/log
  • Create the missing directory
    • mkdir audit
  • Change the ownership and permissions.
    • chmod 700 audit
    • chown root:root audit
  • Wait for 1 minute
  • Check service status again, It should be active now.
    • systemctl status auditd.service

Modification History

2026-02-16 : Article Created