Detections
Analytics

6.2.1.3 Ensure audit_backlog_limit is configured

Information

The audit_backlog_limit parameter determines how many audit records can be held in the audit backlog.

During boot if audit=1, then the backlog will hold 64 records. If more than 64 records are created during boot, audit records will be lost and potential malicious activity could go undetected.

Solution

Run the following command to add audit_backlog_limit=<BACKLOG SIZE> to GRUB_CMDLINE_LINUX:

# grubby --update-kernel ALL --args 'audit_backlog_limit=<BACKLOG SIZE>'

Example:

# grubby --update-kernel ALL --args 'audit_backlog_limit=8192'

Edit /etc/default/grub and add audit_backlog_limit=<BACKLOG SIZE> to the GRUB_CMDLINE_LINUX= line between the opening and closing double quotes:

Example:

GRUB_CMDLINE_LINUX="quiet audit_backlog_limit=8192"

Note: audit_backlog_limit is a kernel boot parameter; the change takes effect on the next reboot.

Impact:

A larger audit_backlog_limit reserves more kernel memory for the boot-time audit backlog buffer; the default of 64 may be too small and drop early-boot audit records.

See Also

https://workbench.cisecurity.org/benchmarks/27890

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-2, 800-53|AU-12, CSCv7|6.2

Plugin: Unix

Control ID: 156a8eb2f65654e413338dacd892bd2cc5357cac12e7d3fcd1db2b7a37f9e5b7