At the command line, run the following command to find the current auditd log location: # grep -iw log_file /etc/audit/auditd.conf Example result: log_file = /var/log/audit/audit.log At the command line, run the following command using the file found in the previous step to verify auditd logs are protected from authorized access: # stat -c "%n %U:%G %a" /var/log/audit/audit.log Example result: /var/log/audit/audit.log root:root 600 If the audit log file does not have permissions set to "0600", this is a finding. If the audit log file is not owned by root, this is a finding. If the audit log file is not group owned by root, this is a finding.