How to enable systemd's journal audit transport?

Solution 1:

I would check these things:

• The systemd-journald-audit.socket is configured to listen to a socket using the AF_NETLINK protocol. If systemctl status systemd-journald-audit.socket is not active, then systemd-journald.service is not using it.

• Ensure systemd-journald-audit.socket is included inSockets=systemd-journald.socket systemd-journald-dev-log.socket systemd-journald-audit.socket in the systemd-journald.service definition.

  If missing from your default systemd-journald.service, create an override at /etc/systemd/system/systemd-journald.service.d/override.conf:

  # systemctl edit systemd-journald.service
  [Service]
  Sockets=
  Sockets=systemd-journald.socket systemd-journald-dev-log.socket systemd-journald-audit.socket
  # systemctl restart systemd-journald.service
  

• audit=0 has not been set as a kernel parameter. Check with cat /proc/cmdline.

Verify that audit is now in your set of field type _TRANSPORT

# journalctl --field _TRANSPORT
stdout
kernel
syslog
journal
audit
driver