← Back to VMware vSphere 7.0 vCenter Appliance Photon OS Security Technical Implementation Guide

V-256544

CAT II (Medium)

The Photon operating system must ensure audit events are flushed to disk at proper intervals.

Rule ID

SV-256544r991589_rule

STIG

VMware vSphere 7.0 vCenter Appliance Photon OS Security Technical Implementation Guide

Version

V1R4

CCIs

CCI-000366

Discussion

Without setting a balance between performance and ensuring all audit events are written to disk, performance of the system may suffer or the risk of missing audit entries may be too high.

Check Content

At the command line, run the following command:

# grep -E "freq|flush" /etc/audit/auditd.conf

Expected result:

flush = INCREMENTAL_ASYNC
freq = 50

If the output does not match the expected result, this is a finding.

Fix Text

Navigate to and open:

/etc/audit/auditd.conf

Ensure the following line is present and any existing "flush" and "freq" settings are removed:

flush = INCREMENTAL_ASYNC
freq = 50