在docker容器中运行auditd
我想在centos docker容器中configurationrsyslog客户端，我注意到下面的错误。 看起来像rsyslogd正在退出由于审计失败。
任何想法如何让rsyslog服务工作在centosdocker集装箱内？
试过这个build议，但没有运气。
May 16 09:49:35 ad5de951dcd4 auditd[312]: Started dispatcher: /sbin/audispd pid: 316 May 16 09:49:35 ad5de951dcd4 auditd[312]: Unable to set initial audit startup state to 'enable', exiting May 16 09:49:35 ad5de951dcd4 auditd[312]: The audit daemon is exiting. May 16 09:49:35 ad5de951dcd4 systemd: auditd.service: main process exited, code=exited, status=1/FAILURE May 16 09:49:35 ad5de951dcd4 audispd: syslog plugin initialized May 16 09:49:35 ad5de951dcd4 audispd: audispd initialized with q_depth=150 and 1 active plugins May 16 09:49:35 ad5de951dcd4 augenrules: /sbin/augenrules: No change May 16 09:49:35 ad5de951dcd4 auditctl: The audit system is disabled May 16 09:49:35 ad5de951dcd4 systemd: Failed to start Security Auditing Service. May 16 09:49:35 ad5de951dcd4 systemd: Unit auditd.service entered failed state. May 16 09:49:35 ad5de951dcd4 systemd: auditd.service failed. May 16 09:49:53 ad5de951dcd4 systemd: Starting Security Auditing Service... May 16 09:49:53 ad5de951dcd4 auditd[330]: Started dispatcher: /sbin/audispd pid: 333 May 16 09:49:53 ad5de951dcd4 auditd[330]: Unable to set initial audit startup state to 'enable', exiting May 16 09:49:53 ad5de951dcd4 auditd[330]: The audit daemon is exiting. May 16 09:49:53 ad5de951dcd4 systemd: auditd.service: main process exited, code=exited, status=1/FAILURE May 16 09:49:53 ad5de951dcd4 audispd: syslog plugin initialized May 16 09:49:53 ad5de951dcd4 audispd: audispd initialized with q_depth=150 and 1 active plugins May 16 09:49:53 ad5de951dcd4 augenrules: /sbin/augenrules: No change May 16 09:49:53 ad5de951dcd4 auditctl: The audit system is disabled May 16 09:49:53 ad5de951dcd4 systemd: Failed to start Security Auditing Service. May 16 09:49:53 ad5de951dcd4 systemd: Unit auditd.service entered failed state. May 16 09:49:53 ad5de951dcd4 systemd: auditd.service failed. May 16 10:09:57 ad5de951dcd4 systemd: Reloading. May 16 10:10:02 ad5de951dcd4 systemd: Reloading. May 16 10:10:10 ad5de951dcd4 rsyslogd: [origin software="rsyslogd" swVersion="7.4.7" x-pid="421" x-info="http://www.rsyslog.com"] exiting on signal 2. 对不起，这并不能直接解决rsyslog问题，而是会给你一个调查的途径。
auditd目前在docker中不起作用（我碰到过类似的问题），看看这个主题：
https://www.redhat.com/archives/linux-audit/2016-February/msg00011.html
因此，如果审计对您的使用不是至关重要的，您应该find一种方法在rsyslog中禁用该function。