From upstream report: https://github.com/linux-audit/audit-userspace/issues/272

Due to the Debian patch 01-no-refusemanualstop.patch auditd can be
restarted manually.
The systemd service file does not provide an `ExecStop=` directive,
thus (according to systemd.service[1]):

on service stops (system shutdown, package upgrade, manual restart
(due to configuration change), etc.) systemd sends SIGTERM (see
systemd.kill[2])) to all process in the control group of the unit,
including dispatch plugins like sedispatch.
This can lead to syslog noise like:

    Aug 04 12:26:19 dlaptop sedispatch[864]: sedispatch is exiting on
stop request
    Aug 04 12:26:19 dlaptop auditd[862]: plugin /usr/sbin/sedispatch
terminated unexpectedly
    Aug 04 12:26:19 dlaptop auditd[862]: plugin /usr/sbin/sedispatch
was restarted
    Aug 04 12:26:19 dlaptop sedispatch[5277]: sedispatch is exiting on stdin EOF

Maybe consider adding (see [2] for details):

    [Service]
    KillMode=mixed


[1]: https://www.freedesktop.org/software/systemd/man/systemd.service.html
[2]: https://www.freedesktop.org/software/systemd/man/systemd.kill.html

On Fri, 19 Aug 2022 19:42:50 +0200 =?UTF-8?Q?Christian_G=C3=B6ttsche?=  <cgzones@googlemail.com> wrote:

 > From upstream report:
https://github.com/linux-audit/audit-userspace/issues/272
 >

As mentioned in the upstream bug, I think that this should also be set
upstream as on shutdown/reboot, systemd WILL stop auditd too

I'm not sure that should be applied to debian only

We believe that the bug you reported is fixed in the latest version of
audit, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1017736@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Laurent Bigonville <bigon@debian.org> (supplier of updated audit package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 19 Sep 2026 13:17:07 +0200
Source: audit
Architecture: source
Version: 1:4.2.1-1
Distribution: unstable
Urgency: medium
Maintainer: Laurent Bigonville <bigon@debian.org>
Changed-By: Laurent Bigonville <bigon@debian.org>
Closes: 1017736 1103527 1133333
Changes:
 audit (1:4.2.1-1) unstable; urgency=medium
 .
   * New upstream version 4.2.1
     - Set KillMode=mixed in auditd.service file (Closes: #1017736)
     - debian/patches/debian-tmpfiles.patch: Refreshed
     - Do not move the bash completion file anymore bash completion file has
       been moved to /usr/share/ upstream
     - Enable TLS transport support
   * debian/tests/control: Rename pkg-config to pkgconf, to please lintian
   * debian/control: Bump Standards-Version to 4.7.4 (no further changes)
   * d/p/03-Set-log_group-adm.patch: Fix the manpage too so it matches the
     default in Debian (Closes: #1103527)
   * debian/control: Add Conflicts against laurel << 0.7.1-2~
     Prior to this version, laurel pacakge was setting wrong permissions on
     /etc/audit and /etc/audit/plugins.d (Closes: #1133333)
   * debian/control: Drop ancient Breaks: audispd-plugins (<< 1:3.0~)
Checksums-Sha1:
 fb0a3ddfe366f2ea7c99859e91874ebf89239173 2596 audit_4.2.1-1.dsc
 1f1cab3ae44ebd900e1dfc2b0ce97a79c0b53b66 756167 audit_4.2.1.orig.tar.gz
 dc2a4223aa9dceb66cf1c5f0f78dfef5d93271eb 20112 audit_4.2.1-1.debian.tar.xz
 e198e0c5b64c617df75437ab33e6bc1fb1cc0e61 6002 audit_4.2.1-1_source.buildinfo
Checksums-Sha256:
 775e511a60cceef4ad45c7ab5c2bd7cb44821d2184b33ea380690b7b87d8856e 2596 audit_4.2.1-1.dsc
 42876d195ee2ded19e5f72d7664096eee314928aa36ad346719ba5b25818fc84 756167 audit_4.2.1.orig.tar.gz
 c307cd6c16d45e53c5760de982446c614e9064a397b5345b4e14fa1a75cac8cf 20112 audit_4.2.1-1.debian.tar.xz
 0e337238e8ba506e958fae8f1a11b26b0a3c394707771af0d092e5bfd8b4f6b3 6002 audit_4.2.1-1_source.buildinfo
Files:
 79f37421db5207425b74dbb70f5fccd7 2596 libs optional audit_4.2.1-1.dsc
 6f61e4f4557da6890afc319b7c9168a8 756167 libs optional audit_4.2.1.orig.tar.gz
 28cc7384ff8abc6c0a67c4728b8c8319 20112 libs optional audit_4.2.1-1.debian.tar.xz
 e024be4abf5834ee86beee60a7eb7edf 6002 libs optional audit_4.2.1-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQFFBAEBCgAvFiEEmRrdqQAhuF2x31DwH8WJHrqwQ9UFAmqucHQRHGJpZ29uQGRl
Ymlhbi5vcmcACgkQH8WJHrqwQ9WclAgAjZ4BmDzzdUXO4tytTBiA8bDNrfoxv9wS
PRKhRGtJJwXWy33sRxXXzfwvvh5fjhMA96WHkDglKPB5wPEIU6GEaO0eDWB9YM6w
KwnJveVrr1RZJCy9Tvx/5TxAOuTCkS8+X8gXfGlDeGcxiXfJHDQzIRU22lDgAj7V
Jh+PRsn5rNvt/MKra7BauTp53Of6NR2vXRlE/b8ZF0wTmMQii2fcxLmttNi/Ax+G
F5G5OYDrMNd8RuUSRbZIdQmB+8QisPtEvbTZ1r0je1acCEj9dwMZ141PugttIljQ
8rPRg4EJPD+2rBzxkCJsxoFJP2UiC8loOOegyqO4UdXfX+msIFMx3g==
=NbZH
-----END PGP SIGNATURE-----