FM / multi-user.target.wants

/etc/systemd/system/multi-user.target.wants/

/etc/systemd/system/multi-user.target.wants

Name	Size	Mode	Actions
aibolit-resident.service	947	0644	edit dl rm
atd.service	222	0644	edit dl rm
auditd.service	1852	0644	edit dl rm
chronyd.service	551	0644	edit dl rm
cpanel-onboot.service	684	0644	edit dl rm
cpanel.service	716	0644	edit dl rm
cpanelquotaonboot.service	324	0644	edit dl rm
cpipv6.service	548	0644	edit dl rm
crond.service	356	0644	edit dl rm
csf.service	270	0644	edit dl rm
dovecot.service	362	0644	edit dl rm
ea-php74-php-fpm.service	716	0644	edit dl rm
ea-php82-php-fpm.service	716	0644	edit dl rm
exim.service	427	0644	edit dl rm
fastmail.service	316	0644	edit dl rm
httpd.service	608	0644	edit dl rm
imunify-antivirus.service	3843	0644	edit dl rm
imunify-notifier.service	388	0644	edit dl rm
ipaliases.service	654	0644	edit dl rm
irqbalance.service	475	0644	edit dl rm
lfd.service	226	0644	edit dl rm
mailman.service	248	0644	edit dl rm
mariadb.service	5528	0644	edit dl rm
mdmonitor.service	310	0644	edit dl rm
nfs-client.target	413	0644	edit dl rm
nftables.service	393	0644	edit dl rm
nscd.service	512	0644	edit dl rm
pdns.service	1426	0644	edit dl rm
pure-authd.service	282	0644	edit dl rm
pure-ftpd.service	312	0644	edit dl rm
remote-fs.target	522	0644	edit dl rm
rpcbind.service	544	0644	edit dl rm
rsyslog.service	960	0644	edit dl rm
securetmp.service	352	0644	edit dl rm
smartd.service	329	0644	edit dl rm
sshd.service	456	0644	edit dl rm
sssd.service	772	0644	edit dl rm
sw-engine.service	515	0644	edit dl rm
sysstat.service	475	0644	edit dl rm
tuned.service	439	0644	edit dl rm
wp-toolkit-background-tasks.service	341	0644	edit dl rm
wp-toolkit-scheduled-tasks.service	339	0644	edit dl rm

Edit: /usr/lib/systemd/system/auditd.service (1852B)

[Unit]
Description=Security Auditing Service
DefaultDependencies=no
## If auditd is sending or recieving remote logging, copy this file to
## /etc/systemd/system/auditd.service and comment out the first After and
## uncomment the second so that network-online.target is part of After.
## then comment the first Before and uncomment the second Before to remove
## sysinit.target from "Before".
After=local-fs.target systemd-tmpfiles-setup.service
##After=network-online.target local-fs.target systemd-tmpfiles-setup.service
Before=sysinit.target shutdown.target
##Before=shutdown.target
Conflicts=shutdown.target
RefuseManualStop=yes
ConditionKernelCommandLine=!audit=0
ConditionKernelCommandLine=!audit=off

Documentation=man:auditd(8) https://github.com/linux-audit/audit-documentation

[Service]
Type=forking
PIDFile=/run/auditd.pid
ExecStart=/sbin/auditd
## To not use augenrules, copy this file to /etc/systemd/system/auditd.service
## and comment/delete the next line and uncomment the auditctl line.
## NOTE: augenrules expect any rules to be added to /etc/audit/rules.d/
ExecStartPost=-/sbin/augenrules --load
#ExecStartPost=-/sbin/auditctl -R /etc/audit/audit.rules
# By default we don't clear the rules on exit. To enable this, uncomment
# the next line after copying the file to /etc/systemd/system/auditd.service
#ExecStopPost=/sbin/auditctl -R /etc/audit/audit-stop.rules
Restart=on-failure
# Do not restart for intentional exits. See EXIT CODES section in auditd(8).
RestartPreventExitStatus=2 4 6

### Security Settings ###
MemoryDenyWriteExecute=true
LockPersonality=true
# The following control prevents rules on /proc so its off by default
#ProtectControlGroups=true
## The following control prevents rules on /usr/lib/modules/ its off by default
#ProtectKernelModules=true
RestrictRealtime=true

[Install]
WantedBy=multi-user.target

cmd: