Audit records must include the outcome (success or failure) of the events that occurred.
Severity | Group ID | Group Title | Version | Rule ID | Date | STIG Version |
|---|---|---|---|---|---|---|
| medium | V-216257 | SRG-OS-000041 | SOL-11.1-010180 | SV-216257r958420_rule | 2026-02-19 | 3 |
Description
Tracking both the successful and unsuccessful attempts aids in identifying threats to the system.
ℹ️ Check
The Audit Configuration profile is required.
This check applies to the global zone only. Determine the zone that you are currently securing.
# zonename
If the command output is "global", this check applies.
Check the status of the audit system. It must be auditing.
# pfexec auditconfig -getcond
If this command does not report:
audit condition = auditing
this is a finding.
✔️ Fix
The Audit Control profile is required.
This action applies to the global zone only. Determine the zone that you are currently securing.
# zonename
If the command output is "global", this action applies.
If auditing has been disabled, it must be enabled with the following command:
# pfexec audit -s