OL 9 must have the audispd-plugins package installed.

audispd-plugins provides plug-ins for the real-time interface to the audit subsystem, audispd. These plug-ins can do things like relay events to remote machines or analyze events for suspicious behavior.

Verify that OL 9 has the audispd-plugins package for installed with the following command:

$ dnf list --installed audispd-plugins

Example output: Installed Packages audispd-plugins.x86_64 3.1.2-2.0.1.el9 @ol9_baseos_latest

If the audispd-plugins package is not installed, this is a finding.

The audispd-plugins package can be installed with the following command:

$ sudo dnf install -y audispd-plugins