停止auditd服务的时候提示失败，有如下提示：
Failed to stop auditd.service: Operation refused, unit auditd.service may be requested by dependency only.
See system logs and ‘systemctl status auditd.service’ for details.
看样子是可能是有依赖关系导致的，查看auditd的服务文件
——————————————————————————————————————————–
[Unit]
Description=Security Auditing Service
DefaultDependencies=no
After=local-fs.target systemd-tmpfiles-setup.service
Conflicts=shutdown.target
Before=sysinit.target shutdown.target
RefuseManualStop=yes
ConditionKernelCommandLine=!audit=0
Documentation=man:auditd(8) https://people.redhat.com/sgrubb/audit/
[Service]
ExecStart=/sbin/auditd -n
## To not use augenrules, copy this file to /etc/systemd/system/auditd.service
## and comment/delete the next line and uncomment the auditctl line.
## NOTE: augenrules expect any rules to be added to /etc/audit/rules.d/
ExecStartPost=-/sbin/augenrules –load
#ExecStartPost=-/sbin/auditctl -R /etc/audit/audit.rules
ExecReload=/bin/kill -HUP $MAINPID
# By default we don’t clear the rules on exit. To enable this, uncomment
# the next line after copying the file to /etc/systemd/system/auditd.service
#ExecStopPost=/sbin/auditctl -R /etc/audit/audit-stop.rules
[Install]
WantedBy=multi-user.target
——————————————————————————————————————————–
发现 “RefuseManualStop=yes”这一行。
嗯，居然还有这种操作……
注释掉关闭服务然后禁用开机启动，或者直接禁用开机启动然后重启