OpenControls Logo

STIG Viewer

STIGViewer Support

RHEL 9 must periodically flush audit records to disk to prevent the loss of audit records.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-258168RHEL-09-653095SV-258168r958428_ruleCCI-000154medium
Description
If option "freq" is not set to a value that requires audit records being written to disk after a threshold number is reached, then audit records may be lost.
STIGDate
Red Hat Enterprise Linux 9 Security Technical Implementation Guide2026-02-05

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

MON-02.2Central Review & Analysis
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (43) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(10)Shared and Group Account Credential Change
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-4Information Flow Enforcement
1.00
AC-6(10)Prohibit Non-privileged Users from Executing Privileged Functions
1.00
AC-6(9)Log Use of Privileged Functions
1.00

+33 more (top 10 by confidence shown)

CCI1 mapping
CCI-000154
1.00

Details

Check Text (C-258168r958428_chk)

Verify that audit system is configured to flush to disk after every 100 records with the following command: $ sudo grep freq /etc/audit/auditd.conf freq = 100 If "freq" isn't set to a value between "1" and "100", the value is missing, or the line is commented out, this is a finding.

Fix Text (F-61833r943023_fix)

Configure RHEL 9 to flush audit to disk by adding or updating the following rule in "/etc/audit/auditd.conf": freq = 100 The audit daemon must be restarted for the changes to take effect.