# Problems restarting auditd on Centos7 - "Unable to restart service auditd: Failed to restart auditd.service: Operation refused"

**URL:** <https://forum.ansible.com/t/problems-restarting-auditd-on-centos7-unable-to-restart-service-auditd-failed-to-restart-auditd-service-operation-refused/24203>\
**Category:** Ansible Project\
**Tags:** ubuntu\
**Created:** [April 12, 2017, 3:18pm UTC](https://forum.ansible.com/t/problems-restarting-auditd-on-centos7-unable-to-restart-service-auditd-failed-to-restart-auditd-service-operation-refused/24203 "2017-04-12T15:18:35Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mike\_Eriksson](https://avatars.discourse-cdn.com/v4/letter/m/d6d6ee/32.png) [@Mike\_Eriksson](https://forum.ansible.com/u/Mike_Eriksson)\
**Post date:** [April 12, 2017, 3:18pm UTC](https://forum.ansible.com/t/problems-restarting-auditd-on-centos7-unable-to-restart-service-auditd-failed-to-restart-auditd-service-operation-refused/24203/1 "2017-04-12T15:18:35Z")

</div>

Hi All,

I’m currently trying to build a role to maintain auditd across our machines. We got a couple of different flavours of Linux as well as versions thereof running in our environment so I’m trying to get it to work across all of them.

This is mainly working well, unless I count Centos 7.

When the config and/or rules files have been updated I’m calling a handler named ‘reload\_auditd’ which looks as follows:

- name: reload\_auditd  
service:  
name: auditd  
state: restarted

This works fine on Centos6 and Ubuntu but Centos 7 fires the following error message:

← Cut →   
fatal: [nsm-rh-silk]: FAILED! =\> {“changed”: false, “failed”: true, “msg”: “Unable to restart service auditd: Failed to restart auditd.service: Operation refused, unit auditd.service may be requested by dependency only.\nSee system logs and ‘systemctl status auditd.service’ for details.\n”}  
 ← Cut →

I had a look in the archive of this mailing list and could find one previous question where the only reply ended with: “in short, use the service command.”. Since I am using the service command I’m a little bit stuck here - does anyone have any further info/help to provide?

Thanks in advance, Mike

---

<div class="post-metadata">

**Author:** ![Mike\_Eriksson](https://avatars.discourse-cdn.com/v4/letter/m/d6d6ee/32.png) [@Mike\_Eriksson](https://forum.ansible.com/u/Mike_Eriksson)\
**Post date:** [April 13, 2017, 6:37am UTC](https://forum.ansible.com/t/problems-restarting-auditd-on-centos7-unable-to-restart-service-auditd-failed-to-restart-auditd-service-operation-refused/24203/2 "2017-04-13T06:37:07Z")

</div>

Just some further info.

I updated to Ansible 2.3.0 but the problem still persists.

Just to test things, I wrote a bit of a ‘dirty’ handler like this:

← Cut →

- name: reload\_auditd\_C7  
command: service “{{ audit\_service }}” restart

← Cut →

This works, although it throws a warning: “[WARNING]: Consider using service module rather than running service”

To me it starts to feel like there might be some kind of bug when it comes to this?

Cheers, Mike

---

<div class="post-metadata">

**Author:** ![Phonthip\_Namkaew](https://avatars.discourse-cdn.com/v4/letter/p/eada6e/32.png) [@Phonthip\_Namkaew](https://forum.ansible.com/u/Phonthip_Namkaew)\
**Post date:** [April 13, 2017, 7:12am UTC](https://forum.ansible.com/t/problems-restarting-auditd-on-centos7-unable-to-restart-service-auditd-failed-to-restart-auditd-service-operation-refused/24203/3 "2017-04-13T07:12:32Z")

</div>

a)  
Which Ansible version is in use? Same behavior with 2.2.2 or 2.3.0?  
b)  
Can you run successfully the following on the command line ( centos 7 )?  
systemctl status auditd.service  
systemctl restart auditd.service

Does the Ansible user have the rights to restart auditd.service ?

c)  
Ugli hack as a last resort, use Ansible Modul command instead of  
Ansible module service for centos 7 only.

---

<div class="post-metadata">

**Author:** ![Mike\_Eriksson](https://avatars.discourse-cdn.com/v4/letter/m/d6d6ee/32.png) [@Mike\_Eriksson](https://forum.ansible.com/u/Mike_Eriksson)\
**Post date:** [April 13, 2017, 7:23am UTC](https://forum.ansible.com/t/problems-restarting-auditd-on-centos7-unable-to-restart-service-auditd-failed-to-restart-auditd-service-operation-refused/24203/4 "2017-04-13T07:23:44Z")

</div>

Hi there,

a) I have the same behavior on both versions.

b) The status command works, the restart command doesn’t. If I run ‘service auditd restart’ it works as expected.

c) I did another ugly hack that works, for now. I got a handler that looks like this. It fires a warning that I should use the ‘service’ command instead though. 😉

← Cut →

- name: reload\_auditd\_C7  
command: service auditd restart

← Cut →

It almost looks like using the ‘service’ command in Ansible against Centos7 actually calls the ‘systemctl’ functionality in the other end?

Cheers, Mike