RHEL 9 must label all offloaded audit logs before sending them to the central log server.
An XCCDF Rule
Description
Enriched logging is needed to determine who, what, and when events occur on a system. Without this, determining root cause of an event will be much more difficult. When audit logs are not labeled before they are sent to a central log server, the audit data will not be able to be analyzed and tied back to the correct system. Satisfies: SRG-OS-000039-GPOS-00017, SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224
- ID
- SV-258161r958416_rule
- Version
- RHEL-09-653060
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
Edit the /etc/audit/auditd.conf file and add or update the "name_format" option:
name_format = hostname
The audit daemon must be restarted for changes to take effect.