Tri-Lab Operating System Stack (TOSS) 5 Security Technical Implementation Guide

The Tri-Lab Operating System Stack (TOSS) 5 Security Technical Implementation Guide (V1 R2) has 391 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

391STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R2

CurrentPublished Wed Sep 30 2026

TOSS 5 must periodically flush audit records to disk to prevent the loss of audit records.

Tri-Lab Operating System Stack (TOSS) 5 Security Technical Implementation Guide

Assessment Title

Rule Text

TOSS 5 must periodically flush audit records to disk to prevent the loss of audit records.

Description

Discussion Text

If option "freq" is not set to a value that requires audit records being written to disk after a threshold number is reached, then audit records may be lost.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-282430

Rule

SV-282430r1200270_rule

Severity

medium

Rule Version

TOSS-05-000403

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Verify the audit system is configured to flush to disk after every 100 records using the following command:

$ sudo grep freq /etc/audit/auditd.conf 

freq = 100 

If "freq" isn't set to a value between "1" and "100", the value is missing, or the line is commented out, this is a finding.

Implementation Procedure

Fix Text

Configure TOSS 5 to flush audit to disk by adding or updating the following rule in "/etc/audit/auditd.conf":

freq = 100

Restart the audit daemon for the changes to take effect.

STIG check 78 of 391 in the Tri-Lab Operating System Stack (TOSS) 5 STIG checklist

← Previous · V-282429TOSS 5 must take appropriate action when a critical audit processing failure occurs.Next · V-282431 →TOSS 5 audit logs must be group-owned by root or by a restricted logging group to prevent unauthorized read access.