Detections
Analytics

PHTN-40-000016 - The Photon operating system must enable the auditd service.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. To that end, the auditd service must be configured to start automatically and be running at all times.

Satisfies: SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000062-GPOS-00031, SRG-OS-000255-GPOS-00096, SRG-OS-000363-GPOS-00150, SRG-OS-000365-GPOS-00152, SRG-OS-000446-GPOS-00200

Solution

At the command line, run the following commands:

# systemctl enable auditd
# systemctl start auditd

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_8-0_Y24M08_STIG.zip

Item Details

References: CAT|II, CCI|CCI-000132, CCI|CCI-000133, CCI|CCI-000134, CCI|CCI-000135, CCI|CCI-000169, CCI|CCI-001487, CCI|CCI-001744, CCI|CCI-002699, CCI|CCI-003938, Rule-ID|SV-258808r1003628_rule, STIG-ID|PHTN-40-000016, Vuln-ID|V-258808

Plugin: Unix

Control ID: 08b170ce3c101eb857fdbc1f00c0a036c86d14fbe887b1368bc875997fa0cb18