FM / multi-user.target.wants

/etc/systemd/system/multi-user.target.wants/

/etc/systemd/system/multi-user.target.wants

Name	Size	Mode	Actions
agent360.service	135	0644	edit dl rm
aibolit-resident.service	947	0644	edit dl rm
atd.service	274	0644	edit dl rm
auditd.service	2030	0644	edit dl rm
chronyd.service	1468	0644	edit dl rm
cpanel-onboot.service	684	0644	edit dl rm
cpanel.service	716	0644	edit dl rm
cpanelquotaonboot.service	324	0644	edit dl rm
cpipv6.service	548	0644	edit dl rm
crond.service	371	0644	edit dl rm
dovecot.service	362	0644	edit dl rm
ea-php81-php-fpm.service	716	0644	edit dl rm
ea-php82-php-fpm.service	716	0644	edit dl rm
exim.service	427	0644	edit dl rm
fastmail.service	316	0644	edit dl rm
firewalld.service	613	0644	edit dl rm
httpd.service	608	0644	edit dl rm
imunify-agent-proxy.service	816	0644	edit dl rm
imunify-antivirus.service	3843	0644	edit dl rm
imunify-notifier.service	388	0644	edit dl rm
ipaliases.service	654	0644	edit dl rm
irqbalance.service	1069	0644	edit dl rm
kdump.service	461	0644	edit dl rm
mailman.service	248	0644	edit dl rm
mysqld.service	2120	0644	edit dl rm
NetworkManager.service	1390	0644	edit dl rm
nfs-client.target	433	0644	edit dl rm
nscd.service	512	0644	edit dl rm
pdns.service	1527	0644	edit dl rm
pure-authd.service	282	0644	edit dl rm
pure-ftpd.service	312	0644	edit dl rm
remote-fs.target	530	0644	edit dl rm
rpcbind.service	544	0644	edit dl rm
rsyslog.service	999	0644	edit dl rm
securetmp.service	352	0644	edit dl rm
smartd.service	334	0644	edit dl rm
sshd.service	372	0644	edit dl rm
sssd.service	768	0644	edit dl rm
sw-engine.service	515	0644	edit dl rm
sysstat.service	475	0644	edit dl rm
vmtoolsd.service	374	0644	edit dl rm
wp-toolkit-background-tasks.service	341	0644	edit dl rm
wp-toolkit-scheduled-tasks.service	339	0644	edit dl rm

Edit: /usr/lib/systemd/system/auditd.service (2030B)

Documentation=man:auditd(8) https://github.com/linux-audit/audit-documentation

[Service]
Type=forking
PIDFile=/run/auditd.pid
ExecStart=/sbin/auditd
## To not use augenrules, copy this file to /etc/systemd/system/auditd.service
## and comment/delete the next line and uncomment the auditctl line.
## NOTE: augenrules expect any rules to be added to /etc/audit/rules.d/
ExecStartPost=-/sbin/augenrules --load
#ExecStartPost=-/sbin/auditctl -R /etc/audit/audit.rules
# By default we don't clear the rules on exit. To enable this, uncomment
# the next line after copying the file to /etc/systemd/system/auditd.service
#ExecStopPost=/sbin/auditctl -R /etc/audit/audit-stop.rules
Restart=on-failure
# Do not restart for intentional exits. See EXIT CODES section in auditd(8).
RestartPreventExitStatus=2 4 6

### Security Settings ###
MemoryDenyWriteExecute=true
LockPersonality=true
# The following control prevents rules on /proc so its off by default
#ProtectControlGroups=true
## The following control prevents rules on /usr/lib/modules/ its off by default
#ProtectKernelModules=true
RestrictRealtime=true

[Install]
WantedBy=multi-user.target

[Unit] Description=Security Auditing Service DefaultDependencies=no ## If auditd is sending or recieving remote logging, copy this file to ## /etc/systemd/system/auditd.service and comment out the first After and ## uncomment the second so that network-online.target is part of After. ## then comment the first Before and uncomment the second Before to remove ## sysinit.target from "Before". ## If using remote logging, ensure that the systemd-update-utmp.service file ## is updated to remove the After=auditd.service directive to prevent a ## boot-time ordering cycle. After=local-fs.target systemd-tmpfiles-setup.service ##After=network-online.target local-fs.target systemd-tmpfiles-setup.service Before=sysinit.target shutdown.target ##Before=shutdown.target Conflicts=shutdown.target RefuseManualStop=yes ConditionKernelCommandLine=!audit=0 ConditionKernelCommandLine=!audit=off Documentation=man:auditd(8) https://github.com/linux-audit/audit-documentation [Service] Type=forking PIDFile=/run/auditd.pid ExecStart=/sbin/auditd ## To not use augenrules, copy this file to /etc/systemd/system/auditd.service ## and comment/delete the next line and uncomment the auditctl line. ## NOTE: augenrules expect any rules to be added to /etc/audit/rules.d/ ExecStartPost=-/sbin/augenrules --load #ExecStartPost=-/sbin/auditctl -R /etc/audit/audit.rules # By default we don't clear the rules on exit. To enable this, uncomment # the next line after copying the file to /etc/systemd/system/auditd.service #ExecStopPost=/sbin/auditctl -R /etc/audit/audit-stop.rules Restart=on-failure # Do not restart for intentional exits. See EXIT CODES section in auditd(8). RestartPreventExitStatus=2 4 6 ### Security Settings ### MemoryDenyWriteExecute=true LockPersonality=true # The following control prevents rules on /proc so its off by default #ProtectControlGroups=true ## The following control prevents rules on /usr/lib/modules/ its off by default #ProtectKernelModules=true RestrictRealtime=true [Install] WantedBy=multi-user.target