PHTN-30-000010 - The Photon operating system must configure auditd to log to disk.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version


Without establishing what type of events occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack.

Audit record content must be shipped to a central location, but it must also be logged locally.

Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019


Navigate to and open:


Ensure the 'write_logs' line is uncommented and set to the following:

write_logs = yes

At the command line, run the following command:

# killproc auditd -TERM
# systemctl start auditd

See Also

Item Details

References: CAT|II, CCI|CCI-000130, CCI|CCI-000132, CCI|CCI-000133, CCI|CCI-000134, Rule-ID|SV-256487r887135_rule, STIG-ID|PHTN-30-000010, Vuln-ID|V-256487

Plugin: Unix

Control ID: a6c0f77166feff3d7105e21a5856ed33c18004cb526263c0d03aa4e770842681