Detections
Analytics

6.2.1.1 Ensure auditd packages are installed

Information

audit is the userspace component of the Linux Auditing System. It is responsible for writing audit records to disk.

The capturing of system events provides system administrators with information to allow them to determine if unauthorized access to their system is occurring.

Solution

Run the following command to install audit and audit-libs :

# dnf install audit audit-libs

Impact:

With auditd installed and running, the system records audit events, which consumes some CPU and disk space for the audit logs; size audit log storage and retention accordingly.

See Also

https://workbench.cisecurity.org/benchmarks/27890

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-2, 800-53|AU-12, CSCv7|6.2

Plugin: Unix

Control ID: dbc05da3f3601368ee8cd3157e851a01945ef9a219e347bd55136899f12a5460