The Photon operating system must have the auditd service running.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-256490 | PHTN-30-000013 | SV-256490r958422_rule | CCI-000135 | medium |
| Description | ||||
| Event outcomes can include indicators of event success or failure and event-specific results (e.g., the security state of the information system after the event occurred). They also provide a means to measure the impact of an event and help authorized personnel to determine the appropriate response. Satisfies: SRG-OS-000042-GPOS-00021, SRG-OS-000062-GPOS-00031, SRG-OS-000255-GPOS-00096, SRG-OS-000363-GPOS-00150, SRG-OS-000365-GPOS-00152, SRG-OS-000445-GPOS-00199, SRG-OS-000446-GPOS-00200, SRG-OS-000461-GPOS-00205, SRG-OS-000467-GPOS-00211, SRG-OS-000465-GPOS-00209, SRG-OS-000474-GPOS-00219, SRG-OS-000475-GPOS-00220 | ||||
| STIG | Date | |||
| VMware vSphere 7.0 vCenter Appliance Photon OS Security Technical Implementation Guide | 2024-12-16 | |||
Details
Check Text (C-256490r958422_chk)
At the command line, run the following command:
# systemctl status auditd
If the service is not running, this is a finding.
Fix Text (F-60108r887143_fix)
At the command line, run the following commands:
# systemctl enable auditd
# systemctl start auditd