Detections
Analytics

5.2.1.3 Ensure audit_backlog_limit is sufficient

Information

The backlog limit has a default setting of 64

During boot if audit=1, then the backlog will hold 64 records. If more that 64 records are created during boot, auditd records will be lost and potential malicious activity could go undetected.

Solution

Run the following command to add audit_backlog_limit=<BACKLOG SIZE> to GRUB_CMDLINE_LINUX:

# grubby --update-kernel ALL --args 'audit_backlog_limit=<BACKLOG SIZE>'

Example:

# grubby --update-kernel ALL --args 'audit_backlog_limit=8192'

See Also

https://workbench.cisecurity.org/benchmarks/12705

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-2, 800-53|AU-3, 800-53|AU-7, 800-53|AU-12, CSCv7|6.2

Plugin: Unix

Control ID: 2e2a3868e94d3a8e9a818848aa5be4b64d4a17345730c5424459e7d29958d02b