UCF STIG Viewer Logo

The system must forward audit records to the syslog service.


Finding ID Version Rule ID IA Controls Severity
V-218092 RHEL-06-000509 SV-218092r505923_rule Low
The auditd service does not include the ability to send audit records to a centralized server for management directly. It does, however, include an audit event multiplexor plugin (audispd) to pass audit records to the local syslog server.
Red Hat Enterprise Linux 6 Security Technical Implementation Guide 2020-09-03


Check Text ( C-19573r377291_chk )
Verify the audispd plugin is active:

# grep active /etc/audisp/plugins.d/syslog.conf

If the "active" setting is missing or set to "no", this is a finding.
Fix Text (F-19571r377292_fix)
Set the "active" line in "/etc/audisp/plugins.d/syslog.conf" to "yes". Restart the auditd process.

# service auditd restart