The operating system must shut down by default upon audit failure (unless availability is an overriding concern).

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-216041	SRG-OS-000047	SOL-11.1-010420	SV-216041r1038966_rule	2024-11-25	3

Description
Continuing to operate a system without auditing working properly can result in undocumented access or system changes.

ℹ️ Check
The Audit Configuration profile is required. This check applies to the global zone only. Determine the zone that you are currently securing. # zonename If the command output is "global", this check applies. # pfexec auditconfig -getpolicy \| grep ahlt If the output does not include "ahlt" as an active audit policy, this is a finding. # pfexec auditconfig -getpolicy \| grep active \| grep cnt If the output includes "cnt" as an active audit policy, this is a finding.

ℹ️ Check

The Audit Configuration profile is required. This check applies to the global zone only. Determine the zone that you are currently securing. # zonename If the command output is "global", this check applies. # pfexec auditconfig -getpolicy | grep ahlt If the output does not include "ahlt" as an active audit policy, this is a finding. # pfexec auditconfig -getpolicy | grep active | grep cnt If the output includes "cnt" as an active audit policy, this is a finding.

✔️ Fix
The Audit Configuration profile is required. This action applies to the global zone only. Determine the zone that you are currently securing. # zonename If the command output is "global", this action applies. Set audit policy to halt and suspend on failure. # pfexec auditconfig -setpolicy +ahlt # pfexec auditconfig -setpolicy -cnt