highauditverified ✓rollback-safe
Ensure auditd service is enabled and active
auditd-enabled · UBUNTU ≥ 22, RHEL ≥ 8 · 1 impl
Description
The auditd service must be enabled and running.
Rationale
The auditd service provides essential system functionality. If it is not running, the system may not meet security requirements.
Check → Remediate
Checkservice_state
- name:
- auditd
- enabled:
- true
- active:
- true
Remediateservice_enabled
- name:
- auditd
Framework references
CIS
rhel8 6.3.1.4rhel9 6.3.1.4rhel10 6.3.1.4ubuntu24 6.2.1.2ubuntu22 6.2.1.2
STIG
V-244542 / RHEL-08-030181V-258152 / RHEL-09-653015V-270657 / UBTU-24-100410V-260591 / UBTU-22-653015V-280994 / RHEL-10-200661
NIST 800-53
AU-2AU-3AU-12
Live verification
rhel10:checkrhel8:checkrhel9:checkubuntu22:checkubuntu24:checkubuntu26:check
#service#audit#auditd