highsystemverified ✓
Enable auditing in GRUB kernel parameters
grub-audit-enabled · RHEL ≥ 8, UBUNTU ≥ 22 · 1 impl
Description
The audit=1 kernel parameter must be set to enable auditing for processes that start before auditd. This ensures all system activity is captured from boot.
Rationale
Without audit=1, processes started early in the boot sequence before auditd loads are not audited. This could allow early compromise activities to go unrecorded.
Check → Remediate
Checkgrub_parameter
- key:
- audit
- expected:
- 1
Remediategrub_parameter_set
- key:
- audit
- value:
- 1
Framework references
CIS
rhel9 6.3.1.2rhel10 6.3.1.2rhel8 6.3.1.2
STIG
V-281097 / RHEL-10-500005V-257796 / RHEL-09-212055V-230468V-270676 / UBTU-24-102010V-260471 / UBTU-22-212015
NIST 800-53
AU-2AU-12
Live verification
rhel10:checkrhel8:checkrhel9:checkubuntu22:checkubuntu24:check
#grub#audit#boot#kernel