mediumauditverified ✓rollback-safe
Configure auditd log format to ENRICHED
auditd-log-format · RHEL ≥ 8 · 1 impl
Description
The auditd log_format parameter must be set to ENRICHED to include user and group name resolution in audit records.
Rationale
The ENRICHED format resolves UIDs and GIDs to names at log time, making audit records more readable and useful for security analysis without requiring external lookups.
Check → Remediate
Checkconfig_value
- path:
- /etc/audit/auditd.conf
- key:
- log_format
- expected:
- ENRICHED
Remediateconfig_set
- path:
- /etc/audit/auditd.conf
- key:
- log_format
- value:
- ENRICHED
- separator:
- =
- restart:
- auditd
Framework references
STIG
V-258169V-230395V-281110 / RHEL-10-500120
NIST 800-53
AU-3
Live verification
rhel10:checkrhel8:checkrhel9:check
#audit#auditd#configuration