← Back to VMware vRealize Operations Manager 6.x SLES Security Technical Implementation Guide

V-239580

CAT II (Medium)

The SLES for vRealize must initiate session audits at system start-up.

Rule ID

SV-239580r662191_rule

STIG

VMware vRealize Operations Manager 6.x SLES Security Technical Implementation Guide

Version

V2R2

CCIs

CCI-001464

Discussion

If auditing is enabled late in the start-up process, the actions of some start-up processes may not be audited. Some audit systems also maintain state information only available if auditing is enabled before a given process is created.

Check Content

Check for the "audit=1" kernel parameter.

# grep "audit=1" /proc/cmdline

If no results are returned, this is a finding.

Fix Text

Edit the grub bootloader file "/boot/grub/menu.lst" by appending the "audit=1" parameter to the kernel boot line.

Reboot the system for the change to take effect.