The system must forward audit records to the syslog service.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-219587	OL6-00-000509	SV-219587r793844_rule		Low

Description
The auditd service does not include the ability to send audit records to a centralized server for management directly. It does, however, include an audit event multiplexor plugin (audispd) to pass audit records to the local syslog server.

STIG	Date
Oracle Linux 6 Security Technical Implementation Guide	2021-12-03

Details

Check Text ( C-21312r358301_chk )
Verify the audispd plugin is active: # grep active /etc/audisp/plugins.d/syslog.conf If the "active" setting is missing or set to "no", this is a finding.

Fix Text (F-21311r358302_fix)
Set the "active" line in "/etc/audisp/plugins.d/syslog.conf" to "yes". Restart the auditd process. # service auditd restart