The audit-audispd-plugins must be installed on the SUSE operating system.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-217197 | SLES-12-020070 | SV-217197r958754_rule | CCI-001851 | medium |
| Description | ||||
| Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity. | ||||
| STIG | Date | |||
| SUSE Linux Enterprise Server 12 Security Technical Implementation Guide | 2025-05-14 | |||
Details
Check Text (C-217197r958754_chk)
Verify that the "audit-audispd-plugins" package is installed on the SUSE operating system.
Check that the "audit-audispd-plugins" package is installed on the SUSE operating system with the following command:
# zypper se audit-audispd-plugins
If the "audit-audispd-plugins" package is not installed, this is a finding.
Verify the "au-remote" plugin is enabled with the following command:
# grep -i active /etc/audisp/plugins.d/au-remote.conf
active = yes
If "active" is missing, commented out, or is not set to "yes", this is a finding.
Fix Text (F-18423r369748_fix)
Install the "audit-audispd-plugins" package on the SUSE operating system by running the following command:
# sudo zypper install audit-audispd-plugins
In /etc/audisp/plugins.d/au-remote.conf, change the value of "active" to "yes", or add "active = yes" if no such setting exists in the file.