[root@ip-10-242-1-172 ~]# journalctl -xeu audit-rules.service ~ ~ Oct 31 02:42:43 localhost systemd[1]: Starting audit-rules.service - Load Audit Rules... ░░ Subject: A start job for unit audit-rules.service has begun execution ░░ Defined-By: systemd ░░ Support: https://wiki.rockylinux.org/rocky/support ░░ ░░ A start job for unit audit-rules.service has begun execution. ░░ ░░ The job identifier is 356. Oct 31 02:42:44 localhost augenrules[1050]: Syscall name unknown: rename Oct 31 02:42:44 localhost augenrules[1050]: Error adding syscalls for perm filtering Oct 31 02:42:44 localhost augenrules[1050]: There was an error in line 6 of /etc/audit/audit.rules Oct 31 02:42:44 localhost augenrules[1050]: No rules Oct 31 02:42:44 localhost augenrules[1050]: enabled 1 Oct 31 02:42:44 localhost augenrules[1050]: failure 1 Oct 31 02:42:44 localhost augenrules[1050]: pid 1002 Oct 31 02:42:44 localhost augenrules[1050]: rate_limit 0 Oct 31 02:42:44 localhost augenrules[1050]: backlog_limit 8192 Oct 31 02:42:44 localhost augenrules[1050]: lost 0 Oct 31 02:42:44 localhost augenrules[1050]: backlog 1 Oct 31 02:42:44 localhost augenrules[1050]: backlog_wait_time 6000 Oct 31 02:42:44 localhost augenrules[1050]: backlog_wait_time_actual 0 Oct 31 02:42:44 localhost augenrules[1050]: enabled 1 Oct 31 02:42:44 localhost augenrules[1050]: failure 1 Oct 31 02:42:44 localhost augenrules[1050]: pid 1002 Oct 31 02:42:44 localhost augenrules[1050]: rate_limit 0 Oct 31 02:42:44 localhost augenrules[1050]: backlog_limit 8192 Oct 31 02:42:44 localhost augenrules[1050]: lost 0 Oct 31 02:42:44 localhost augenrules[1050]: backlog 4 Oct 31 02:42:44 localhost augenrules[1050]: backlog_wait_time 6000 Oct 31 02:42:44 localhost augenrules[1050]: backlog_wait_time_actual 0 Oct 31 02:42:45 localhost systemd[1]: audit-rules.service: Main process exited, code=exited, status=1/FAILURE ░░ Subject: Unit process exited ░░ Defined-By: systemd ░░ Support: https://wiki.rockylinux.org/rocky/support ░░ ░░ An ExecStart= process belonging to unit audit-rules.service has exited. ░░ ░░ The process' exit code is 'exited' and its exit status is 1. Oct 31 02:42:45 localhost systemd[1]: audit-rules.service: Failed with result 'exit-code'. ░░ Subject: Unit failed ░░ Defined-By: systemd ░░ Support: https://wiki.rockylinux.org/rocky/support ░░ ░░ The unit audit-rules.service has entered the 'failed' state with result 'exit-code'. Oct 31 02:42:45 localhost systemd[1]: Failed to start audit-rules.service - Load Audit Rules. ░░ Subject: A start job for unit audit-rules.service has failed ░░ Defined-By: systemd ░░ Support: https://wiki.rockylinux.org/rocky/support ░░ ░░ A start job for unit audit-rules.service has finished with a failure. ░░ ░░ The job identifier is 356 and the job result is failed.