logo标签列表

在 Docker 容器中运行 auditd

linuxdockercentos
5
我试图在CentOS Docker容器中配置rsyslog客户端，但发现以下错误。看起来是由于auditd失败而导致rsyslogd退出。
有什么想法可以使rsyslog服务在CentOS Docker容器内正常工作吗？
尝试过这个suggestion，但没有成功。
May 16 09:49:35 ad5de951dcd4 auditd[312]: Started dispatcher: /sbin/audispd pid: 316
May 16 09:49:35 ad5de951dcd4 auditd[312]: Unable to set initial audit startup state to 'enable', exiting
May 16 09:49:35 ad5de951dcd4 auditd[312]: The audit daemon is exiting.
May 16 09:49:35 ad5de951dcd4 systemd: auditd.service: main process exited, code=exited, status=1/FAILURE
May 16 09:49:35 ad5de951dcd4 audispd: syslog plugin initialized
May 16 09:49:35 ad5de951dcd4 audispd: audispd initialized with q_depth=150 and 1 active plugins
May 16 09:49:35 ad5de951dcd4 augenrules: /sbin/augenrules: No change
May 16 09:49:35 ad5de951dcd4 auditctl: The audit system is disabled
May 16 09:49:35 ad5de951dcd4 systemd: Failed to start Security Auditing Service.
May 16 09:49:35 ad5de951dcd4 systemd: Unit auditd.service entered failed state.
May 16 09:49:35 ad5de951dcd4 systemd: auditd.service failed.
May 16 09:49:53 ad5de951dcd4 systemd: Starting Security Auditing Service...
May 16 09:49:53 ad5de951dcd4 auditd[330]: Started dispatcher: /sbin/audispd pid: 333
May 16 09:49:53 ad5de951dcd4 auditd[330]: Unable to set initial audit startup state to 'enable', exiting
May 16 09:49:53 ad5de951dcd4 auditd[330]: The audit daemon is exiting.
May 16 09:49:53 ad5de951dcd4 systemd: auditd.service: main process exited, code=exited, status=1/FAILURE
May 16 09:49:53 ad5de951dcd4 audispd: syslog plugin initialized
May 16 09:49:53 ad5de951dcd4 audispd: audispd initialized with q_depth=150 and 1 active plugins
May 16 09:49:53 ad5de951dcd4 augenrules: /sbin/augenrules: No change
May 16 09:49:53 ad5de951dcd4 auditctl: The audit system is disabled
May 16 09:49:53 ad5de951dcd4 systemd: Failed to start Security Auditing Service.
May 16 09:49:53 ad5de951dcd4 systemd: Unit auditd.service entered failed state.
May 16 09:49:53 ad5de951dcd4 systemd: auditd.service failed.
May 16 10:09:57 ad5de951dcd4 systemd: Reloading.
May 16 10:10:02 ad5de951dcd4 systemd: Reloading.
May 16 10:10:10 ad5de951dcd4 rsyslogd: [origin software="rsyslogd" swVersion="7.4.7" x-pid="421" x-info="http://www.rsyslog.com"] exiting on signal 2.
请将您的Dockerfile添加到您的问题中。 - Cyrus
我正在使用基本的CentOS容器，并在该容器内使用以下命令安装了一些服务： yum install rsyslog rsyslog-doc yum install rsyslog-gnutls yum -y install audit yum -y install initscripts - Mkm
1个回答
1
抱歉，这并不能直接解决rsyslog问题，但会为您提供调查的途径。
当前docker中无法使用auditd（我也遇到了类似的问题），请参考此线程：
https://www.redhat.com/archives/linux-audit/2016-February/msg00011.html 因此，如果auditd对您的使用不是关键的话，您应该找到一种方法在rsyslog中禁用它。
网页内容由stack overflow 提供, 点击上面的
可以查看英文原文，
原文链接