How to know exactly when a Linux service went inactive? | journalctl --boot=-1 SYSLOG_IDENTIFIER=audit

On RHEL (like Fedora) though, you probably have audit enabled. This did the job for me
# journalctl --boot=-1 SYSLOG_IDENTIFIER=audit
...
Dec 30 13:51:38 localhost.localdomain audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=fprintd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
...
Dec 30 13:52:08 localhost.localdomain audit[1]: SERVICE_STOP pid=1 uid=0 auid=4294967295 se

Comments

Popular posts from this blog

HAproxy logging

teamcity Automatic Agent Start under Linux

NFS mount add in fstab _netdev instead of default | firewall-cmd --list-all