mediumauditverified ✓rollback-safe
Configure auditd name format to include hostname
auditd-name-format · RHEL ≥ 8 · 1 impl
Description
The auditd name_format parameter must be set to hostname so that audit records include the originating system's hostname for identification when off-loaded to a central log server.
Rationale
Without hostname identification in audit records, it becomes difficult to determine which system generated a particular audit event when records are aggregated centrally.
Check → Remediate
Checkconfig_value
- path:
- /etc/audit/auditd.conf
- key:
- name_format
- expected:
- hostname
Remediateconfig_set
- path:
- /etc/audit/auditd.conf
- key:
- name_format
- value:
- hostname
- separator:
- =
- restart:
- auditd
Framework references
STIG
V-230394V-281105 / RHEL-10-500045V-258161 / RHEL-09-653060
NIST 800-53
AU-3
Live verification
rhel10:checkrhel8:checkrhel9:check
#audit#auditd#configuration