And it's not running after that? Nothing listening on port 1515?
Which version of OSSEC?

ossec 2.9.3.
When I do ps -ef|grep ossec then I can see ossec running but systemctl keep on failing which is an issue. So my ansible scripts are dying due to this.

I'll have to try and figure out how systemctl is trying to run authd. It's not really built to be a long-running daemon or anything.

But if I want to register agents automatically without user involvement then I suppose authd is the solution.

So if I understand correctly ossec-authd is getting started correctly but it is not generating any pid file due to which systemd is failing as it cannot find any pid file.

From more debugging I understand that ossec-authd is creating pid file in /var/ossec/var/run/ while systemctl is searching for it in /var/run thus failing.

@ddpbsd This line present in the init script for ossec-hids-authd is causing the issue
# pidfile: /var/run/ossec-authd.pid

This makes systemd to think that pid file is present here, please remove this in your next release. After removing this line I was able to run ossec-hids-auth perfectly from init script.

I had add:
PIDFILE=ossec-authd.pid

to get it to work.

none of these solutions works for me. How hard is it to write a SystemD service file anyhow?

Solved.
Edit the init.d script as follows:

Change: # pidfile: /var/ossec/var/run/ossec-authd.pid
To: #### pidfile: /var/ossec/var/run/ossec-authd.pid

Add: PIDFILE=/var/ossec/var/run/ossec-authd.pid
below: PIDDIR=/var/ossec/var/run