发现auditd 服务有问题
进行重启
systemctl restart auditd
Failed to restart auditd.service: Operation refused, unit auditd.service may be requested by dependency only
The audit daemon must be controlled from the service command. It will decide which commands can be sent to systemctl and which ones are supported by legacy actions. So, you should do:
service auditd restart
Unfortunately, it has to be this way.