OL 9 must write audit records to disk.
Severity | Group ID | Group Title | Version | Rule ID | Date | STIG Version |
|---|---|---|---|---|---|---|
| medium | V-271602 | SRG-OS-000480-GPOS-00227 | OL09-00-000880 | SV-271602r1092590_rule | 2025-05-08 | 1 |
| Description |
|---|
| Audit data should be synchronously written to disk to ensure log integrity. This setting ensures that all audit event data is written disk. |
| ℹ️ Check |
|---|
| Verify that OL 9 audit system is configured to write logs to the disk with the following command: $ sudo grep write_logs /etc/audit/auditd.conf write_logs = yes If "write_logs" does not have a value of "yes", the line is commented out, or the line is missing, this is a finding. |
| ✔️ Fix |
|---|
| Configure the audit system to write log files to the disk. Edit the /etc/audit/auditd.conf file and add or update the "write_logs" option to "yes": write_logs = yes The audit daemon must be restarted for changes to take effect. Restart auditd: $ sudo service auditd restart |