Detections
Analytics

6.2.1.4 Ensure auditd service is enabled and active

Information

The auditd service is the userspace daemon of the Linux Auditing System. When enabled and active it records system events to the audit log.

The capturing of system events provides system administrators with information to allow them to determine if unauthorized access to their system is occurring.

Solution

Run the following commands to unmask, enable, and start auditd :

# systemctl unmask auditd
# systemctl enable auditd
# systemctl start auditd

Impact:

Running auditd records system events, which consumes some CPU and disk space for the audit logs.

See Also

https://workbench.cisecurity.org/benchmarks/27890

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-2, 800-53|AU-12, CSCv7|6.2

Plugin: Unix

Control ID: c29ebf0aca5400f3c7530dc3d5e56acaf599a43dd6e6383bade195553409106c