Error with Firefox on Centos 7.1 and Xvfb

The answer is in /etc/systemd/system/multi-user.target.wants/auditd.service

[Service]
ExecStart=/sbin/auditd -n
## To not use augenrules, copy this file to /etc/systemd/system/auditd.service
## and comment/delete the next line and uncomment the auditctl line.
## NOTE: augenrules expect any rules to be added to /etc/audit/rules.d/
ExecStartPost=-/sbin/augenrules --load
#ExecStartPost=-/sbin/auditctl -R /etc/audit/audit.rules
ExecReload=/bin/kill -HUP $MAINPID

So starting the service calls augenrules. Note that the service is only started on server startup.

You can mask and unmask service. Masking is like disabling a service. It not only makes sure that service is not started automatically anymore, but even ensures that a service cannot even be started manually anymore. Mask command symply makes symlink to /dev/null like this:

 $ ln -s /dev/null /etc/systemd/system/sshd.service
 $ systemctl daemon-reload

Masking a service is a permanent change, much like disabling a service.

Enable service first:

systemctl unmask sshd.service

See more about systemd : systemd for Administrators, Part V by Lennart Poettering