Bug 1219064 - [Build :31967:systemd] Error sending add rule data request (Rule exists)
Summary: [Build :31967:systemd] Error sending add rule data request (Rule exists)
Status: NEW
Alias: None
Product: PUBLIC SUSE Linux Enterprise Server 15 SP5
Classification: openSUSE
Component: systemd (show other bugs)
Version: unspecified
Hardware: Other Other
: P5 - None : Normal
Target Milestone: ---
Assignee: Enzo Matsumiya
QA Contact:
URL: https://openqa.suse.de/tests/13307076...
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-01-22 15:14 UTC by Anton Smorodskyi
Modified: 2024-01-23 10:17 UTC (History)
2 users (show)

See Also:
Found By: openQA
Services Priority:
Business Priority:
Blocker: Yes
Marketing QA Status: ---
IT Deployment: ---

Attachments
Journalctl output (123.17 KB, text/x-log)
2024-01-22 15:14 UTC, Anton Smorodskyi 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Anton Smorodskyi 2024-01-22 15:14:11 UTC 
Created attachment 872064 [details]
Journalctl output

## Observation

openQA test in scenario sle-15-SP5-Azure-BYOS-Hardened-Incidents-x86_64-publiccloud_img_proof@az_Standard_B2s fails in
[img_proof](https://openqa.suse.de/tests/13307076/modules/img_proof/steps/34)

In journalctl output you may find following message : 

```
Jan 22 09:26:53 openqa-suse-de-a06bec2b64c475ed systemd[1]: Finished Apply settings from /etc/sysconfig/keyboard.
Jan 22 09:26:53 openqa-suse-de-a06bec2b64c475ed augenrules[641]: /sbin/augenrules: No change
Jan 22 09:26:53 openqa-suse-de-a06bec2b64c475ed augenrules[766]: Error sending add rule data request (Rule exists)
Jan 22 09:26:53 openqa-suse-de-a06bec2b64c475ed augenrules[766]: There was an error in line 65 of /etc/audit/audit.rules
Jan 22 09:26:53 openqa-suse-de-a06bec2b64c475ed augenrules[766]: No rules
Jan 22 09:26:53 openqa-suse-de-a06bec2b64c475ed systemd[1]: augenrules.service: Main process exited, code=exited, status=1/FAILURE
Jan 22 09:26:53 openqa-suse-de-a06bec2b64c475ed systemd[1]: augenrules.service: Failed with result 'exit-code'.
Jan 22 09:26:53 openqa-suse-de-a06bec2b64c475ed systemd[1]: Failed to start auditd rules generation.
```




## Further details

Always latest result in this scenario: [latest](https://openqa.suse.de/tests/latest?arch=x86_64&distri=sle&flavor=Azure-BYOS-Hardened-Incidents&machine=az_Standard_B2s&test=publiccloud_img_proof&version=15-SP5)
Comment 1 Anton Smorodskyi 2024-01-22 15:22:22 UTC 
1. Most probably related to incident http://dashboard.qam.suse.de/incident/31967
2. Issue happening during system boot 
3. As of now no functional regressions was found which may relate to this errors
Comment 2 Franck Bui 2024-01-23 08:58:35 UTC 
After some investigation on an affected system (thanks Anton for providing me access) it appears that the problem is unrelated to systemd as a manual "augenrules --load" shows the same error:

  Error sending add rule data request (Rule exists)
  There was an error in line 65 of /etc/audit/audit.rules

Reassigning to auditd maintainer.
Comment 3 Anton Smorodskyi 2024-01-23 10:17:16 UTC 
(In reply to Franck Bui from comment #2)
> After some investigation on an affected system (thanks Anton for providing
> me access) it appears that the problem is unrelated to systemd as a manual
> "augenrules --load" shows the same error:
> 
>   Error sending add rule data request (Rule exists)
>   There was an error in line 65 of /etc/audit/audit.rules
> 
> Reassigning to auditd maintainer.

Some clarification for auditd maintainer : **problem happens only in Hardened images **