Ubuntu 22.04 The auditd service should be enabled if possible. multi-user.target auditd.service multi-user.target auditd.socket ^auditd\.(socket|service)$ ActiveState active auditd