PHTN-67-000059 - The Photon operating system must configure a cron job to rotate auditd logs daily - bash


Audit logs are most useful when accessible by date, rather than size. This can be accomplished through a combination of an audit log rotation cron job, setting a reasonable number of logs to keep and configuring auditd to not rotate the logs on its own. This ensures that audit logs are accessible to the ISSO in the event of a central log processing failure.


If /etc/cron.daily/audit-rotate does not exist, run the following commands:

# touch /etc/cron.daily/audit-rotate
# chown root:root /etc/cron.daily/audit-rotate
# chmod 0700 /etc/cron.daily/audit-rotate

Open /etc/cron.daily/audit-rotate with a text editor.

Set its contents as follows:

service auditd rotate

See Also

Item Details

References: CAT|II, CCI|CCI-001849, Rule-ID|SV-239130r856048_rule, STIG-ID|PHTN-67-000059, Vuln-ID|V-239130

Plugin: Unix

Control ID: f5ca1536c94fc2788c8d6335a0ed0ed7a4b66190ad454000a02de1420e0318c4