The operating system must shut down by default upon audit failure (unless availability is an overriding concern).

Continuing to operate a system without auditing working properly can result in undocumented access or system changes.

The Audit Configuration profile is required.

This check applies to the global zone only. Determine the zone that you are currently securing.

# zonename

If the command output is "global", this check applies.

# pfexec auditconfig -getpolicy | grep ahlt

If the output does not include "ahlt" as an active audit policy, this is a finding.

# pfexec auditconfig -getpolicy | grep active | grep cnt

If the output includes "cnt" as an active audit policy, this is a finding.

The Audit Configuration profile is required.

This action applies to the global zone only. Determine the zone that you are currently securing.

# zonename

If the command output is "global", this action applies.

Set audit policy to halt and suspend on failure.

# pfexec auditconfig -setpolicy +ahlt
# pfexec auditconfig -setpolicy -cnt