mediumauditverified ✓rollback-safe
Configure auditd to write audit records to disk
auditd-write-logs · RHEL ≥ 9 · 1 impl
Description
The auditd write_logs parameter must be set to yes to ensure audit records are written to disk.
Rationale
If audit records are not written to disk, evidence of system activity may be lost and unavailable for forensic analysis or compliance verification.
Check → Remediate
Checkconfig_value
- path:
- /etc/audit/auditd.conf
- key:
- write_logs
- expected:
- yes
Remediateconfig_set
- path:
- /etc/audit/auditd.conf
- key:
- write_logs
- value:
- yes
- separator:
- =
- restart:
- auditd
Framework references
STIG
V-258170V-281099 / RHEL-10-500015
NIST 800-53
AU-9AU-12
Live verification
rhel10:checkrhel9:check
#audit#auditd#configuration