Configure auditd to use audispd's syslog plugin
An XCCDF Rule
Description
To configure the auditd service to use the
syslog plug-in of the audispd audit event multiplexor, set
the active line in /etc/audit/plugins.d/syslog.conf to yes.
Restart the auditd service:
$ sudo service auditd restart
Rationale
The auditd service does not include the ability to send audit records to a centralized server for management directly. It does, however, include a plug-in for audit event multiplexor (audispd) to pass audit records to the local syslog server.
- ID
- xccdf_org.ssgproject.content_rule_auditd_audispd_syslog_plugin_activated
- Severity
- Medium
- References
- Updated