mediumsystemverified ✓
Configure audit backlog limit in GRUB
grub-audit-backlog · RHEL ≥ 8 · 1 impl
Description
The kernel audit_backlog_limit parameter should be set sufficiently high to prevent audit events from being dropped during boot and high-activity periods.
Rationale
If the audit backlog fills before auditd starts or during periods of high system activity, audit events may be lost. A backlog limit of at least 8192 ensures events are captured during boot and high-load situations.
Check → Remediate
Checkgrub_parameter
- key:
- audit_backlog_limit
- expected:
- 8192
Remediategrub_parameter_set
- key:
- audit_backlog_limit
- value:
- 8192
Framework references
CIS
rhel9 6.3.1.3rhel8 6.3.1.3rhel10 6.3.1.3
STIG
V-230469
NIST 800-53
AU-2AU-12
Live verification
rhel10:checkrhel8:checkrhel9:check
#grub#audit#boot#kernel