running auditd in docker container

Question

I am trying to configure the rsyslog client in centos docker container and i noticed below error. looks like rsyslogd is exiting due to the auditd failure.

Any idea how to make rsyslog service to work inside the centos docker container?

Tried this suggestion but no luck.

May 16 09:49:35 ad5de951dcd4 auditd[312]: Started dispatcher: /sbin/audispd pid: 316
May 16 09:49:35 ad5de951dcd4 auditd[312]: Unable to set initial audit startup state to 'enable', exiting
May 16 09:49:35 ad5de951dcd4 auditd[312]: The audit daemon is exiting.
May 16 09:49:35 ad5de951dcd4 systemd: auditd.service: main process exited, code=exited, status=1/FAILURE
May 16 09:49:35 ad5de951dcd4 audispd: syslog plugin initialized
May 16 09:49:35 ad5de951dcd4 audispd: audispd initialized with q_depth=150 and 1 active plugins
May 16 09:49:35 ad5de951dcd4 augenrules: /sbin/augenrules: No change
May 16 09:49:35 ad5de951dcd4 auditctl: The audit system is disabled
May 16 09:49:35 ad5de951dcd4 systemd: Failed to start Security Auditing Service.
May 16 09:49:35 ad5de951dcd4 systemd: Unit auditd.service entered failed state.
May 16 09:49:35 ad5de951dcd4 systemd: auditd.service failed.
May 16 09:49:53 ad5de951dcd4 systemd: Starting Security Auditing Service...
May 16 09:49:53 ad5de951dcd4 auditd[330]: Started dispatcher: /sbin/audispd pid: 333
May 16 09:49:53 ad5de951dcd4 auditd[330]: Unable to set initial audit startup state to 'enable', exiting
May 16 09:49:53 ad5de951dcd4 auditd[330]: The audit daemon is exiting.
May 16 09:49:53 ad5de951dcd4 systemd: auditd.service: main process exited, code=exited, status=1/FAILURE
May 16 09:49:53 ad5de951dcd4 audispd: syslog plugin initialized
May 16 09:49:53 ad5de951dcd4 audispd: audispd initialized with q_depth=150 and 1 active plugins
May 16 09:49:53 ad5de951dcd4 augenrules: /sbin/augenrules: No change
May 16 09:49:53 ad5de951dcd4 auditctl: The audit system is disabled
May 16 09:49:53 ad5de951dcd4 systemd: Failed to start Security Auditing Service.
May 16 09:49:53 ad5de951dcd4 systemd: Unit auditd.service entered failed state.
May 16 09:49:53 ad5de951dcd4 systemd: auditd.service failed.
May 16 10:09:57 ad5de951dcd4 systemd: Reloading.
May 16 10:10:02 ad5de951dcd4 systemd: Reloading.
May 16 10:10:10 ad5de951dcd4 rsyslogd: [origin software="rsyslogd" swVersion="7.4.7" x-pid="421" x-info="http://www.rsyslog.com"] exiting on signal 2.

Answer 1

Sorry this doesn't directly solve the rsyslog issue, but will give you a route of investigation.

auditd doesn't work in docker currently (I ran into similar issues), see this thread:
https://www.redhat.com/archives/linux-audit/2016-February/msg00011.html

So if auditd isn't crucial to your usage you should find a way to disable that in rsyslog.