Detections
Analytics

6.2.1.2 Ensure auditd service is enabled and active

Information

Turn on the auditd daemon to record system events.

The capturing of system events provides system administrators with information to allow them to determine if unauthorized access to their system is occurring.

Solution

Run the following commands to unmask, enable and start auditd :

# systemctl unmask auditd
# systemctl enable auditd
# systemctl start auditd

See Also

https://workbench.cisecurity.org/benchmarks/26893

Item Details

Category: AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|AU-2, 800-53|AU-7, 800-53|AU-12, 800-53|SI-5, CSCv7|6.2, CSCv7|6.3, Rule-ID|SV-238298r958506_rule, Rule-ID|SV-260591r1015023_rule

Plugin: Unix

Control ID: 0b4dc7fb23152fbbe794dc47db3be28c8ae7439ca6adbc1a9da8c080f594319b