OL 9 must write audit records to disk.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-271602 | OL09-00-000880 | SV-271602r1092590_rule | CCI-000366 | medium |
| Description | ||||
| Audit data should be synchronously written to disk to ensure log integrity. This setting ensures that all audit event data is written disk. | ||||
| STIG | Date | |||
| Oracle Linux 9 Security Technical Implementation Guide | 2025-05-08 | |||
Related Frameworks
4 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
CM-6
1.00
- DISA · 1 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1712 mappings
3.4.1
1.00
- DISA · 1 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.4.2
1.00
- DISA · 1 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-000366
1.00
- DISA · 1 · disa_xccdf · related
Details
Check Text (C-271602r1092590_chk)
Verify that OL 9 audit system is configured to write logs to the disk with the following command:
$ sudo grep write_logs /etc/audit/auditd.conf
write_logs = yes
If "write_logs" does not have a value of "yes", the line is commented out, or the line is missing, this is a finding.
Fix Text (F-75559r1092589_fix)
Configure the audit system to write log files to the disk.
Edit the /etc/audit/auditd.conf file and add or update the "write_logs" option to "yes":
write_logs = yes
The audit daemon must be restarted for changes to take effect.
Restart auditd:
$ sudo service auditd restart