SV-258168r958428: RHEL 9 must periodically flush audit records to disk to prevent the loss of audit records. | Red Hat Enterprise Linux 9 STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

RHEL 9 must periodically flush audit records to disk to prevent the loss of audit records.

Description

Discussion Text

If option "freq" is not set to a value that requires audit records being written to disk after a threshold number is reached, then audit records may be lost.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000154

References

DPMS Target Red Hat Enterprise Linux 9 DISA DPMS Target Red Hat Enterprise Linux 9 5551

Checks

DISA STIG (Manual Reference)

Verify that audit system is configured to flush to disk after every 100 records with the following command:

$ sudo grep freq /etc/audit/auditd.conf 

freq = 100 

If "freq" isn't set to a value between "1" and "100", the value is missing, or the line is commented out, this is a finding.

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.stig.rhel9os:def:258168
# RHEL 9 must periodically flush audit records to disk to prevent the loss of audit records.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# /etc/audit/auditd.conf: freq = 1-100
# textfilecontent54_object (textfilecontent54_test)
test_1() {
  ( [ "$(sed -En 's/(?i)^\s*freq\s*=\s*(\S+)\s*(?:#.*)?$/\1/p' '/etc/audit/auditd.conf')" -ge 1 ] ) && ( [ "$(sed -En 's/(?i)^\s*freq\s*=\s*(\S+)\s*(?:#.*)?$/\1/p' '/etc/audit/auditd.conf')" -le 100 ] )
}

if test_1; then
  echo "PASS"
else
  echo "FAIL"
fi

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# OVAL Definition: oval:mil.disa.stig.rhel9os:def:258168

FILEPATH="/etc/audit/auditd.conf"
PATTERN="^\\s*freq\\s*=\\s*(\\S+)\\s*(?:#.*)?$"

if [ ! -f "$FILEPATH" ]; then
  echo "PASS"
  exit 0
fi

grep -E "$PATTERN" "$FILEPATH" | awk -F'=' '{print $2}' | while read -r freq; do
  if [ "$freq" -ge 1 ] && [ "$freq" -le 100 ]; then
    echo "PASS"
    exit 0
  fi
done

echo "FAIL"
exit 1

Remediation

Configure RHEL 9 to flush audit to disk by adding or updating the following rule in "/etc/audit/auditd.conf":

freq = 100

The audit daemon must be restarted for the changes to take effect.