UCF STIG Viewer Logo

The HP-UX AUDOMON_ARGS attribute must be explicitly initialized.


Overview

Finding ID Version Rule ID IA Controls Severity
V-4290 GEN000000-HPUX0040 SV-38429r2_rule ECAR-1 ECAR-2 ECAR-3 Medium
Description
The minimal set of auditing requirements necessary to collect useful forensics data and provide user help when violations are detected must be configured.
STIG Date
HP-UX SMSE Security Technical Implementation Guide 2014-02-28

Details

Check Text ( C-36226r2_chk )
Check the /etc/rc.config.d/auditing file AUDOMON_ARGS settings:

# cat /etc/rc.config.d/auditing | tr “\011” “ “ | tr -s “ “ | sed -e 's/^[ \t]*//' grep -v “#”

The above command should return a single line with the following information:

AUDOMON_ARGS=“-p 20, -t 1, -w 90”

If “p”, “t”, or “w” flags are not set to “20”, “1”, and “90”, respectively, this is a finding.
Fix Text (F-31485r2_fix)
Edit the /etc/rc.config.d/auditing file and insert the following line:

AUDOMON_ARGS=“-p 20, -t 1, -w 90”

Restart auditing:
# /sbin/init.d/auditing stop
# /sbin/init.d/auditing start