Detections
Analytics

1.181 RHEL-10-500125

Information

RHEL 10 must periodically flush audit records to disk to ensure that audit records are not lost.

GROUP ID: V-281111RULE ID: SV-281111r1166285

If option "freq" is not set to a value that requires audit records to be written to disk after a threshold number is reached, audit records may be lost.

Solution

Configure RHEL 10 to flush audit records to disk by adding or updating the following rule in "/etc/audit/rules.d/audit.rules":

freq = 100

Restart the audit daemon with the following command for changes to take effect:

$ sudo service auditd restart

See Also

https://workbench.cisecurity.org/benchmarks/26403

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-6(4), CAT|II, CCI|CCI-000154, Rule-ID|SV-281111r1166285_rule, STIG-ID|RHEL-10-500125, Vuln-ID|V-281111

Plugin: Unix

Control ID: 7e9003fa5b32d281f16af13571a2059358a61eec440cb8929389dd3bc2394a3b