Verify the operating system generates audit records when successful/unsuccessful attempts to access the "/etc/sudoers" file and files in the "/etc/sudoers.d/" directory. Check that the file and directory is being audited by performing the following command: > sudo auditctl -l | grep -w '/etc/sudoers' -w /etc/sudoers -p wa -k privileged-actions -w /etc/sudoers.d -p wa -k privileged-actions If the commands do not return output that match the examples, this is a finding. Notes: The "-k" allows for specifying an arbitrary identifier. The string following "-k" does not need to match the example output above.