Write Audit Logs to the Disk
An XCCDF Rule
Description
To configure Audit daemon to write Audit logs to the disk, set
write_logs to yes in /etc/audit/auditd.conf.
This is the default setting.
Rationale
If write_logs isn't set to yes, the Audit logs will
not be written to the disk.
- ID
- xccdf_org.ssgproject.content_rule_auditd_write_logs
- Severity
- Medium
- References
- Updated
Remediation - Kubernetes Patch
---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
config:
ignition:
Remediation - Shell Script
# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
if [ -e "/etc/audit/auditd.conf" ] ; then
LC_ALL=C sed -i "/^\s*write_logs\s*=\s*/Id" "/etc/audit/auditd.conf"
Remediation - Ansible
- name: Gather the package facts
package_facts:
manager: auto
tags:
- CCE-82356-7
- NIST-800-53-CM-6