Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
RHEL 9 must write audit records to disk.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-258170 | RHEL-09-653105 | SV-258170r991589_rule | Medium |
| Description |
|---|
| Audit data should be synchronously written to disk to ensure log integrity. This setting assures that all audit event data is written disk. |
| STIG | Date |
|---|---|
| Red Hat Enterprise Linux 9 Security Technical Implementation Guide | 2024-06-04 |
Details
| Check Text ( C-61911r926495_chk ) |
|---|
| Verify that the audit system is configured to write logs to the disk with the following command: $ sudo grep write_logs /etc/audit/auditd.conf write_logs = yes If "write_logs" does not have a value of "yes", the line is commented out, or the line is missing, this is a finding. |
| Fix Text (F-61835r926496_fix) |
|---|
| Configure the audit system to write log files to the disk. Edit the /etc/audit/auditd.conf file and add or update the "write_logs" option to "yes": write_logs = yes The audit daemon must be restarted for changes to take effect. |