Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide

The Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide (V1 R8) has 439 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

439STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R8

CurrentPublished Wed Sep 30 2026

AlmaLinux OS 9 audit system must retain an optimal number of audit records.

Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide

Assessment Title

Rule Text

AlmaLinux OS 9 audit system must retain an optimal number of audit records.

Description

Discussion Text

max_log_file (size in megabytes) multiplied by num_logs must make full use of the auditd storage volume (separate to the root partition).

If max_log_file_action is set to ROTATE or KEEP_LOGS then num_logs must be set to a value between 2 and 99.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-269530

Rule

SV-269530r1050413_rule

Severity

medium

Rule Version

ALMA-09-054580

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Verify that AlmaLinux OS 9 is configured to make full use of the auditd storage volume when rotation is enabled, with the following command:

$ grep num_logs /etc/audit/auditd.conf

num_logs = 5

If the value of the "num_logs" option is not between 2 and 99, is commented out, or is missing, this is a finding.

Implementation Procedure

Fix Text

Configure AlmaLinux OS 9 to make full use of the auditd storage volume with rotation enabled.
 
Add or update the following line ("num_logs" can be set to a number between 2 and 99) in the "/etc/audit/auditd.conf" file:
 
num_logs = 5

STIG check 414 of 439 in the Cloud Linux AlmaLinux OS 9 STIG checklist

← Previous · V-269529AlmaLinux OS 9 audit system must take appropriate action when the audit files have reached maximum size.Next · V-269531 →AlmaLinux OS 9 must periodically flush audit records to disk to prevent the loss of audit records.