Running under strace may change the execution environment enough that it's not reflective of the actual error, but it's still worth a shot -- can you pastebin the whole auditd strace logs? That openat() line is actually a success -- the error we're looking for will come from the audit_set_pid(3) function, which uses netlink, which is an incredibly complicated protocol. The error may not look like an error in strace output.
Is there any chance the kernel has logged whatever the failure was in dmesg output? Thanks -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1873627 Title: auditd fails after moving /var it a new filesystem and turning /var/run into a symlink to /run To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/audit/+bug/1873627/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
