← Back to VMware vSphere 8.0 vCenter Appliance Photon OS 4.0 Security Technical Implementation Guide

V-258855

CAT II (Medium)

The Photon operating system must ensure audit events are flushed to disk at proper intervals.

Rule ID

SV-258855r933626_rule

STIG

VMware vSphere 8.0 vCenter Appliance Photon OS 4.0 Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-000366

Discussion

Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. To that end, the auditd service must be configured to start automatically and be running at all times.

Check Content

At the command line, run the following command to verify auditd is configured to flush audit events to disk regularly:

# grep -E "freq|flush" /etc/audit/auditd.conf

Example result:

flush = INCREMENTAL_ASYNC
freq = 50

If "flush" is not set to "INCREMENTAL_ASYNC", this is a finding.
If "freq" is not set to "50", this is a finding.

Fix Text

Navigate to and open:

/etc/audit/auditd.conf

Add or update the following lines:

flush = INCREMENTAL_ASYNC
freq = 50

At the command line, run the following command:

# pkill -SIGHUP auditd