5.3.2 Enable auditd Service

Information

Turn on the auditd daemon to record system events.

Rationale:

The capturing of system events provides system administrators with information to allow them to determine if unauthorized access to their system is occurring.

Solution

Run the following command to enable auditd:

# chkconfig auditd on

Default Value:

OS Default: N/A

See Also

https://workbench.cisecurity.org/files/3096

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-3, 800-53|AU-12, CSCv6|3.1, CSCv7|6.2

Plugin: Unix

Control ID: ae39d9b41f958c586b5cead27c880cba05378d2c10a383fefc913bc76f6d9930