Detections
Analytics

4.1.1.2 Ensure auditd service is enabled and running - running

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Turn on the auditd daemon to record system events.

Rationale:

The capturing of system events provides system administrators with information to allow them to determine if unauthorized access to their system is occurring.

Solution

Run the following command to enable and start auditd:

# systemctl --now enable auditd

See Also

https://workbench.cisecurity.org/files/2854

Item Details

Category: AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT, MAINTENANCE

References: 800-53|AU-3, 800-53|AU-3(1), 800-53|AU-6(4), 800-53|AU-7, 800-53|AU-7(1), 800-53|AU-14(1), 800-53|CM-6, 800-53|MA-4(1), CSCv7|6.2

Plugin: Unix

Control ID: 3a83b314c19ab5ebe408c724c3b815b3baab92ea433f669616d4a81f87fc2738