UCF STIG Viewer Logo

The Photon operating system must have the auditd service running.


Finding ID Version Rule ID IA Controls Severity
V-239090 PHTN-67-000018 SV-239090r675078_rule Medium
Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. To that end, the auditd service must be configured to start automatically and be running at all times. Satisfies: SRG-OS-000062-GPOS-00031, SRG-OS-000042-GPOS-00021, SRG-OS-000255-GPOS-00096, SRG-OS-000363-GPOS-00150, SRG-OS-000365-GPOS-00152, SRG-OS-000445-GPOS-00199, SRG-OS-000446-GPOS-00200, SRG-OS-000461-GPOS-00205, SRG-OS-000465-GPOS-00209, SRG-OS-000467-GPOS-00211, SRG-OS-000474-GPOS-00219, SRG-OS-000475-GPOS-00220
VMware vSphere 6.7 Photon OS Security Technical Implementation Guide 2022-06-17


Check Text ( C-42301r675076_chk )
At the command line, execute the following command:

# service auditd status | grep running

If the service is not running, this is a finding.
Fix Text (F-42260r675077_fix)
At the command line, execute the following command:

# systemctl enable auditd.service
# service auditd start