| The message types that are always recorded to /var/log/audit/audit.log include "LOGIN", "USER_LOGIN", "USER_START", "USER_END" among others and do not need to be added to audit.rules. |
The log files /var/log/faillog, /var/log/lastlog, and /var/log/tallylog must be protected from tampering of the logon records:
# egrep "faillog|lastlog|tallylog" /etc/audit/audit.rules
If /var/log/faillog, /var/log/lastlog, and /var/log/tallylog entries do not exist, this is a finding.