Detections
Analytics
RHEL-10-500035 - RHEL 10 must take appropriate action when a critical audit processing failure occurs.
Information
It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without this notification, the security personnel may be unaware of an impending failure of the audit capability, and system operation may be adversely affected.Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded.
Solution
Configure RHEL 10 to shut down when auditing failures occur.Add the following line to the bottom of the "/etc/audit/rules.d/audit.rules" file:
-f 2
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_RHEL_10_V1R1_STIG.zip
Item Details
Audit Name: DISA Red Hat Enterprise Linux 10 STIG v1r1
Category: AUDIT AND ACCOUNTABILITY
References: 800-53|AU-5a., CAT|II, CCI|CCI-000139, Rule-ID|SV-281103r1166261_rule, STIG-ID|RHEL-10-500035, Vuln-ID|V-281103
Plugin: Unix
Control ID: 44e423e475fa89ae62988e2e02e69a9d2f1c8d1272ca1b2ec088712abe1bdf6d