I have a mystery on my hands. One day /etc/rc5.d/S11auditd
became /etc/rc5.d/K88auditd
and no one takes responsibility for it. It looks like it just happened by itself, which is hardly plausible and requires a little investigation.
Assuming default Fedora 12 installation, what are the ways of tracing actions that led to an auditd
being removed initialization sequence? So far I checked:
/var/log/messages
shows that one time the demon was properly shut down on reboot and never loaded again.
/var/log/audit/audit.log
via ausearch
shows basically the same thing.
chkconfig | grep audit
shows that it is currently shut off, but only on 5th run level.
I even tried .bash_history
with no luck.
last
also shows that no one used ssh
to login remotely.
So, what did i missed? Where to look for more info?