The Photon operating system must ensure audit events are flushed to disk at proper intervals.
Severity | Group ID | Group Title | Version | Rule ID | Date | STIG Version |
|---|---|---|---|---|---|---|
| medium | V-256544 | SRG-OS-000480-GPOS-00227 | PHTN-30-000074 | SV-256544r991589_rule | 2024-12-16 | 1 |
Description
Without setting a balance between performance and ensuring all audit events are written to disk, performance of the system may suffer or the risk of missing audit entries may be too high.
ℹ️ Check
At the command line, run the following command:
# grep -E "freq|flush" /etc/audit/auditd.conf
Expected result:
flush = INCREMENTAL_ASYNC
freq = 50
If the output does not match the expected result, this is a finding.
✔️ Fix
Navigate to and open:
/etc/audit/auditd.conf
Ensure the following line is present and any existing "flush" and "freq" settings are removed:
flush = INCREMENTAL_ASYNC
freq = 50