Detections
Analytics

1.167 OL09-00-000880

Information

OL 9 must write audit records to disk.

GROUP ID: V-271602
RULE ID: SV-271602r1092590

Audit data should be synchronously written to disk to ensure log integrity. This setting ensures that all audit event data is written disk.

Solution

Configure the audit system to write log files to the disk.

Edit the /etc/audit/auditd.conf file and add or update the "write_logs" option to "yes":

write_logs = yes

The audit daemon must be restarted for changes to take effect.

Restart auditd:

$ sudo service auditd restart

See Also

https://workbench.cisecurity.org/benchmarks/27024

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CCI|CCI-000366, Rule-ID|SV-271602r1092590_rule, STIG-ID|OL09-00-000880, Vuln-ID|V-271602

Plugin: Unix

Control ID: ffa89861d237254389d1c724862449662be9fb52b5b0ace8f196287acee5587e