The Photon operating system must ensure audit events are flushed to disk at proper intervals.

Without setting a balance between performance and ensuring all audit events are written to disk, performance of the system may suffer or the risk of missing audit entries may be too high.

At the command line, run the following command:

# grep -E "freq|flush" /etc/audit/auditd.conf

Expected result:

flush = INCREMENTAL_ASYNC freq = 50

If the output does not match the expected result, this is a finding.

Navigate to and open:

/etc/audit/auditd.conf

Ensure the following line is present and any existing "flush" and "freq" settings are removed:

flush = INCREMENTAL_ASYNC freq = 50