PHTN-30-000011 - The Photon operating system must configure auditd to use the correct log format.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version


To compile an accurate risk assessment and provide forensic analysis, it is essential for security personnel to know exact, unfiltered details of the event in question.


Navigate to and open:


Ensure the 'log_format' line is uncommented and set to the following:

log_format = RAW

At the command line, run the following command:

# killproc auditd -TERM
# systemctl start auditd

See Also

Item Details

References: CAT|II, CCI|CCI-000131, Rule-ID|SV-256488r887138_rule, STIG-ID|PHTN-30-000011, Vuln-ID|V-256488

Plugin: Unix

Control ID: d0ab019ee18e44a3bad9371931b5f6a22330f94092940d413a9a9f51237edd9b