mediumauditverified ✓

Ensure the running and on disk audit configuration is the same

audit-config-on-disk-matches-running · RHEL ≥ 8 · 1 impl

Description

The audit rules loaded in the kernel must match the on-disk rules that augenrules compiles, so a reboot does not silently change the audit policy.

Rationale

If the running audit configuration diverges from what is on disk, a reboot or reload will change auditing unexpectedly — either dropping rules that were added at runtime or loading rules that were removed, creating gaps in the audit trail.

Check → Remediate

Checkcommand

out=$(augenrules --check 2>/dev/null)
if echo "$out" | grep -qi 'should be updated'; then
  echo "FAIL: running audit rules differ from on-disk ($out)"; exit 1
fi
echo "OK: running and on-disk audit rules match"

expected_exit:: 0

Remediatemanual

note:: Reconcile the difference: run `augenrules --load` to load the on-disk rules, or persist any intended runtime rules into /etc/audit/rules.d/ so the two match.

Framework references

CIS

rhel9 6.3.3.21rhel8 6.3.3.22rhel10 6.3.3.37

NIST 800-53

AU-2CM-6

Live verification

rhel9:check

#audit#auditd#configuration-drift