How to properly look for an info about auditd being turned off from init?

Question

I have a mystery on my hands. One day /etc/rc5.d/S11auditd became /etc/rc5.d/K88auditd and no one takes responsibility for it. It looks like it just happened by itself, which is hardly plausible and requires a little investigation.

Assuming default Fedora 12 installation, what are the ways of tracing actions that led to an auditd being removed initialization sequence? So far I checked:

/var/log/messages shows that one time the demon was properly shut down on reboot and never loaded again.

/var/log/audit/audit.log via ausearch shows basically the same thing.

chkconfig | grep audit shows that it is currently shut off, but only on 5th run level.

I even tried .bash_history with no luck.

last also shows that no one used ssh to login remotely.

So, what did i missed? Where to look for more info?

Answer 1

I just had the same problem and have a possible explanation.

In my case, I suspect that it was caused by the readahead package which temporarily disables auditd during boot by changing the rc.d links (see /etc/init/readahead-disable-services.conf). It is supposed to change them back at the end of the boot sequence, but if you interrupt that (e.g. CtrlAltDel or a power cut), then auditd will be left permanently turned off.

There is some discussion about it in https://bugzilla.redhat.com/show_bug.cgi?id=729452.