# Ansible: how to restart auditd service on CentOS7 when it appears you cant even do it via  native systeml command

**URL:** <https://forum.ansible.com/t/ansible-how-to-restart-auditd-service-on-centos7-when-it-appears-you-cant-even-do-it-via-native-systeml-command/23209>\
**Category:** Ansible Project\
**Tags:** rhel\
**Created:** [December 9, 2016, 4:55am UTC](https://forum.ansible.com/t/ansible-how-to-restart-auditd-service-on-centos7-when-it-appears-you-cant-even-do-it-via-native-systeml-command/23209 "2016-12-09T04:55:38Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![matzuba](https://avatars.discourse-cdn.com/v4/letter/m/b38774/32.png) [@matzuba](https://forum.ansible.com/u/matzuba)\
**Post date:** [December 9, 2016, 4:55am UTC](https://forum.ansible.com/t/ansible-how-to-restart-auditd-service-on-centos7-when-it-appears-you-cant-even-do-it-via-native-systeml-command/23209/1 "2016-12-09T04:55:38Z")

</div>

In my playbook, i have a task to update audit.rules and then notify a handler which should restart the auditd service.

```auto
task:
  - name: 6.6.7 - audit rules configuration
    template: src=X/ansible/templates/auditd_rules.j2
              dest=/etc/audit/rules.d/audit.rules
              backup=yes
              owner=root group=root mode=0640
     notify:
   - restart auditd

  handlers:
    - name: restart auditd
      service: name=auditd state=restarted

```

When the playbook runs, the audit rules are updated and a request is made to restart auditd but this fails as below.

```auto
RUNNING HANDLER [restart auditd] ***********************************************
fatal: [ipX-southeast-2.compute.internal]: FAILED! => {"changed": false, "failed": true, "msg": "Unable to restart service auditd: Failed to restart auditd.service: Operation refused, unit auditd.service may be requested by dependency only.\n"}

```

When i look at the unit definition for auditd, i can see refuseManualStop=yes. Is this why i cant restart the service? how does one over come this to pickup the new audit rules?

Is this more of a Centos/RHEL issue?

sudo systemctl restart auditd.service

Failed to restart auditd.service: Operation refused, unit auditd.service may be requested by dependency only.

See system logs and ‘systemctl status auditd.service’ for details.

```auto
 systemctl cat auditd.service
# /usr/lib/systemd/system/auditd.service
[Unit]
Description=Security Auditing Service
DefaultDependencies=no
After=local-fs.target systemd-tmpfiles-setup.service
Conflicts=shutdown.target
Before=sysinit.target shutdown.target
RefuseManualStop=yes
ConditionKernelCommandLine=!audit=0
Documentation=man:auditd(8) https://people.redhat.com/sgrubb/audit/

[Service]
ExecStart=/sbin/auditd -n
## To not use augenrules, copy this file to /etc/systemd/system/auditd.service
## and comment/delete the next line and uncomment the auditctl line.
## NOTE: augenrules expect any rules to be added to /etc/audit/rules.d/
ExecStartPost=-/sbin/augenrules --load
#ExecStartPost=-/sbin/auditctl -R /etc/audit/audit.rules
ExecReload=/bin/kill -HUP $MAINPID
# By default we don't clear the rules on exit. To enable this, uncomment
# the next line after copying the file to /etc/systemd/system/auditd.service
#ExecStopPost=/sbin/auditctl -R /etc/audit/audit-stop.rules

[Install]
WantedBy=multi-user.target

```

---

<div class="post-metadata">

**Author:** ![Kai\_Stian\_Olstad](https://avatars.discourse-cdn.com/v4/letter/k/e19adc/32.png) [@Kai\_Stian\_Olstad](https://forum.ansible.com/u/Kai_Stian_Olstad)\
**Post date:** [December 10, 2016, 9:49am UTC](https://forum.ansible.com/t/ansible-how-to-restart-auditd-service-on-centos7-when-it-appears-you-cant-even-do-it-via-native-systeml-command/23209/2 "2016-12-10T09:49:02Z")

</div>

This is documented behavior  
[https://access.redhat.com/documentation/en-US/Red\_Hat\_Enterprise\_Linux/7/html/Security\_Guide/sec-starting\_the\_audit\_service.html](https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sec-starting_the_audit_service.html)

in short, use the service command.