Ubuntu 16.10 auditd possible incompatibility about go-audit HOT 8 CLOSED

Try disabling auditd with sudo systemctl stop auditd.service

from go-audit.

Feel free to re-open this issue if it is still valid.

from go-audit.

This step of running sudo systemctl stop auditd.service should be better documented.

from go-audit.

Do we know why go-audit doesnt work with auditd now?

from go-audit.

The reason they don't play well together is that go-audit and auditd use a netlink socket to receive audit events from the kernel, only one process can own that socket at a time.

from go-audit.

Was there any change on audit netlink? both go-audit and auditd seem working fine together on my vm with older version of linux.

from go-audit.

Nope, go-audit and auditd are likely fighting each other on the socket in your case. Enable https://github.com/slackhq/go-audit/blob/master/go-audit.yaml.example#L18 and you should see the missed message log lines.

from go-audit.

Got it. Thanks.

from go-audit.