audits服务不能停止

停止auditd服务的时候提示失败,有如下提示:

Failed to stop auditd.service: Operation refused, unit auditd.service may be requested by dependency only.
See system logs and ‘systemctl status auditd.service’ for details.

看样子是可能是有依赖关系导致的,查看auditd的服务文件

——————————————————————————————————————————–

[Unit]
Description=Security Auditing Service
DefaultDependencies=no
After=local-fs.target systemd-tmpfiles-setup.service
Conflicts=shutdown.target
Before=sysinit.target shutdown.target
RefuseManualStop=yes
ConditionKernelCommandLine=!audit=0
Documentation=man:auditd(8) https://people.redhat.com/sgrubb/audit/

[Service]
ExecStart=/sbin/auditd -n
## To not use augenrules, copy this file to /etc/systemd/system/auditd.service
## and comment/delete the next line and uncomment the auditctl line.
## NOTE: augenrules expect any rules to be added to /etc/audit/rules.d/
ExecStartPost=-/sbin/augenrules –load
#ExecStartPost=-/sbin/auditctl -R /etc/audit/audit.rules
ExecReload=/bin/kill -HUP $MAINPID
# By default we don’t clear the rules on exit. To enable this, uncomment
# the next line after copying the file to /etc/systemd/system/auditd.service
#ExecStopPost=/sbin/auditctl -R /etc/audit/audit-stop.rules

[Install]
WantedBy=multi-user.target

——————————————————————————————————————————–

发现 “RefuseManualStop=yes”这一行。

嗯,居然还有这种操作……

注释掉关闭服务然后禁用开机启动,或者直接禁用开机启动然后重启

发表评论

电子邮件地址不会被公开。 必填项已用*标注