Detections
Analytics

1.350 ALMA-09-045670

Information

AlmaLinux OS 9 audit system must audit local events.

GROUP ID: V-269458
RULE ID: SV-269458r1050341

Without establishing what type of events occurred, the source of events, where events occurred, and the outcome of events, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack.

If option "local_events" is not set to "yes", only events from network will be aggregated.

Solution

Configure AlmaLinux OS 9 to generate audit records for local events by adding or updating the following line in "/etc/audit/auditd.conf":

local_events = yes

The audit daemon must be restarted for the changes to take effect.

See Also

https://workbench.cisecurity.org/benchmarks/27039

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-12a., CCI|CCI-000169, Rule-ID|SV-269458r1050341_rule, STIG-ID|ALMA-09-045670, Vuln-ID|V-269458

Plugin: Unix

Control ID: ef33562dd5cf9cd396801a002f81b1e2c4bf63896a8886f4f2aa7cb34f7e7383