The Photon operating system must ensure audit events are flushed to disk at proper intervals.
Severity | Group ID | Group Title | Version | Rule ID | Date | STIG Version |
|---|---|---|---|---|---|---|
| medium | V-256544 | SRG-OS-000480-GPOS-00227 | PHTN-30-000074 | SV-256544r991589_rule | 2024-12-16 | 1 |
| Description |
|---|
| Without setting a balance between performance and ensuring all audit events are written to disk, performance of the system may suffer or the risk of missing audit entries may be too high. |
| ℹ️ Check |
|---|
| At the command line, run the following command: # grep -E "freq|flush" /etc/audit/auditd.conf Expected result: flush = INCREMENTAL_ASYNC freq = 50 If the output does not match the expected result, this is a finding. |
| ✔️ Fix |
|---|
| Navigate to and open: /etc/audit/auditd.conf Ensure the following line is present and any existing "flush" and "freq" settings are removed: flush = INCREMENTAL_ASYNC freq = 50 |