OpenControls Logo

STIG Viewer

STIGViewer Support

OL 9 must periodically flush audit records to disk to prevent the loss of audit records.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-271582OL09-00-000775SV-271582r1092574_ruleCCI-000154medium
Description
If option "freq" is not set to a value that requires audit records being written to disk after a threshold number is reached, then audit records may be lost.
STIGDate
Oracle Linux 9 Security Technical Implementation Guide2026-02-17

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

MON-02.2Central Review & Analysis
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (43) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(10)Shared and Group Account Credential Change
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-4Information Flow Enforcement
1.00
AC-6(10)Prohibit Non-privileged Users from Executing Privileged Functions
1.00
AC-6(9)Log Use of Privileged Functions
1.00

+33 more (top 10 by confidence shown)

CCI1 mapping
CCI-000154
1.00

Details

Check Text (C-271582r1092574_chk)

Verify that OL 9 is configured to flush audit records to disk after every 100 records with the following command: $ sudo grep freq /etc/audit/auditd.conf freq = 100 If "freq" isn't set to a value of "100" or greater, the value is missing, or the line is commented out, this is a finding.

Fix Text (F-75539r1092573_fix)

Configure OL 9 to flush audit to disk by adding or updating the following configuration in "/etc/audit/auditd.conf": freq = 100 The audit daemon must be restarted for the changes to take effect. Restart auditd: $ sudo service auditd restart