Detections
Analytics

1.151 OL09-00-000800

Information

OL 9 audit system must audit local events.

GROUP ID: V-271586
RULE ID: SV-271586r1092576

Without establishing what type of events occurred, the source of events, where events occurred, and the outcome of events, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack.

If option "local_events" isn't set to "yes" only events from network will be aggregated.

Solution

Configure OL 9 to generate audit records for local events by adding or updating the following line in "/etc/audit/auditd.conf":

local_events = yes

The audit daemon must be restarted for the changes to take effect.

Restart auditd:

$ sudo service auditd restart

See Also

https://workbench.cisecurity.org/benchmarks/27024

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-12a., CCI|CCI-000169, Rule-ID|SV-271586r1092576_rule, STIG-ID|OL09-00-000800, Vuln-ID|V-271586

Plugin: Unix

Control ID: 66d133f83c9cdf5ae2f8e326fa403788b7369ad88dbea063b976454dab767b26