Detections
Analytics

6.3.1.3 Ensure audit_backlog_limit is sufficient

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The audit_backlog_limit parameter determines how auditd records can be held in the auditd backlog. The default setting of 64 may be insufficient to store all audit events during boot.

During boot if audit=1, then the backlog will hold 64 records. If more than 64 records are created during boot, auditd records will be lost and potential malicious activity could go undetected.

Solution

Run the following command to add audit_backlog_limit=<BACKLOG SIZE> to GRUB_CMDLINE_LINUX:

# grubby --update-kernel ALL --args 'audit_backlog_limit=<BACKLOG SIZE>'

Example:

# grubby --update-kernel ALL --args 'audit_backlog_limit=8192'

Edit /etc/default/grub and add audit_backlog_limit=<BACKLOG SIZE> to the GRUB_CMDLINE_LINUX= line between the opening and closing double quotes:

Example:

GRUB_CMDLINE_LINUX="quiet audit_backlog_limit=8192"

Note: Other parameters may also be listed

See Also

https://workbench.cisecurity.org/benchmarks/18211

Item Details

References: CSCv7|6.2

Plugin: Unix

Control ID: 2d3a1bbcbc2e7087fe5d94c86dbad5c29945cbd4bf086997b833dcc6f1d6db59