Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-239149 | PHTN-67-000078 | SV-239149r675255_rule | Medium |
Description |
---|
Without setting a balance between performance and ensuring all audit events are written to disk, performance of the system may suffer or the risk of missing audit entries may be too high. |
STIG | Date |
---|---|
VMware vSphere 6.7 Photon OS Security Technical Implementation Guide | 2021-04-15 |
Check Text ( C-42360r675253_chk ) |
---|
At the command line, execute the following command: # grep -E "freq|flush" /etc/audit/auditd.conf Expected result: flush = INCREMENTAL_ASYNC freq = 50 If the output does not match the expected result, this is a finding. |
Fix Text (F-42319r675254_fix) |
---|
Open /etc/audit/auditd.conf with a text editor. Ensure that the line below is present and any existing "flush" and "freq" settings are removed. flush = INCREMENTAL_ASYNC freq = 50 |