mediumauditverified ✓rollback-safe
Configure auditd to periodically flush audit records to disk
auditd-flush · RHEL ≥ 8 · 1 impl
Description
The auditd freq parameter must be configured to periodically flush audit records to disk.
Rationale
Without periodic flushing, audit records held only in memory could be lost during a system crash, destroying evidence of security events that occurred before the crash.
Check → Remediate
Checkconfig_value
- path:
- /etc/audit/auditd.conf
- key:
- freq
- expected:
- 50
Remediateconfig_set
- path:
- /etc/audit/auditd.conf
- key:
- freq
- value:
- 50
- separator:
- =
- restart:
- auditd
Framework references
STIG
V-258168V-281111 / RHEL-10-500125
NIST 800-53
AU-9AU-12
Live verification
rhel10:checkrhel9:check
#audit#auditd#configuration