title: running auditd in docker container
body: <p>I am trying to configure the rsyslog client in centos docker container and i noticed below error. looks like rsyslogd is exiting due to the auditd failure.</p>
  
  <p>Any idea how to make rsyslog service to work inside the centos docker container?</p>
  
  <p>Tried this <a href="https://serverfault.com/questions/824975/systemctl-failed-to-get-d-bus-connection-operation-not-permitted">suggestion</a> but no luck.</p>
  
  <pre><code>May 16 09:49:35 ad5de951dcd4 auditd[312]: Started dispatcher: /sbin/audispd pid: 316
  May 16 09:49:35 ad5de951dcd4 auditd[312]: Unable to set initial audit startup state to 'enable', exiting
  May 16 09:49:35 ad5de951dcd4 auditd[312]: The audit daemon is exiting.
  May 16 09:49:35 ad5de951dcd4 systemd: auditd.service: main process exited, code=exited, status=1/FAILURE
  May 16 09:49:35 ad5de951dcd4 audispd: syslog plugin initialized
  May 16 09:49:35 ad5de951dcd4 audispd: audispd initialized with q_depth=150 and 1 active plugins
  May 16 09:49:35 ad5de951dcd4 augenrules: /sbin/augenrules: No change
  May 16 09:49:35 ad5de951dcd4 auditctl: The audit system is disabled
  May 16 09:49:35 ad5de951dcd4 systemd: Failed to start Security Auditing Service.
  May 16 09:49:35 ad5de951dcd4 systemd: Unit auditd.service entered failed state.
  May 16 09:49:35 ad5de951dcd4 systemd: auditd.service failed.
  May 16 09:49:53 ad5de951dcd4 systemd: Starting Security Auditing Service...
  May 16 09:49:53 ad5de951dcd4 auditd[330]: Started dispatcher: /sbin/audispd pid: 333
  May 16 09:49:53 ad5de951dcd4 auditd[330]: Unable to set initial audit startup state to 'enable', exiting
  May 16 09:49:53 ad5de951dcd4 auditd[330]: The audit daemon is exiting.
  May 16 09:49:53 ad5de951dcd4 systemd: auditd.service: main process exited, code=exited, status=1/FAILURE
  May 16 09:49:53 ad5de951dcd4 audispd: syslog plugin initialized
  May 16 09:49:53 ad5de951dcd4 audispd: audispd initialized with q_depth=150 and 1 active plugins
  May 16 09:49:53 ad5de951dcd4 augenrules: /sbin/augenrules: No change
  May 16 09:49:53 ad5de951dcd4 auditctl: The audit system is disabled
  May 16 09:49:53 ad5de951dcd4 systemd: Failed to start Security Auditing Service.
  May 16 09:49:53 ad5de951dcd4 systemd: Unit auditd.service entered failed state.
  May 16 09:49:53 ad5de951dcd4 systemd: auditd.service failed.
  May 16 10:09:57 ad5de951dcd4 systemd: Reloading.
  May 16 10:10:02 ad5de951dcd4 systemd: Reloading.
  May 16 10:10:10 ad5de951dcd4 rsyslogd: [origin software="rsyslogd" swVersion="7.4.7" x-pid="421" x-info="http://www.rsyslog.com"] exiting on signal 2.
  </code></pre>