4.1.1.2 Ensure auditd service is enabled

Information

Enable and start the auditd daemon to record system events.

Rationale:

The capturing of system events provides system administrators with information to allow them to determine if unauthorized access to their system is occurring.

Solution

Run the following command to enable auditd :

# systemctl --now enable auditd

See Also

https://workbench.cisecurity.org/files/2920