STIGQter: STIG Summary: Red Hat Enterprise Linux 8 Security Technical Implementation Guide Version: 2 Release: 8 Benchmark Date: 01 Jul 2026:

RHEL 8 audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.

DISA Rule

SV-244542r1017348_rule

Vulnerability Number

V-244542

Group Title

SRG-OS-000062-GPOS-00031

Rule Version

RHEL-08-030181

Severity

CAT II

CCI(s)

• CCI-000169 - Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2 a. on organization-defined information system components.

Weight

10

Fix Recommendation

Configure the audit service to produce audit records containing the information needed to establish when (date and time) an event occurred with the following commands:

$ sudo systemctl enable auditd.service

$ sudo systemctl start auditd.service

Check Contents

Verify the audit service is configured to produce audit records with the following command:

$ sudo systemctl status auditd.service

auditd.service - Security Auditing Service
Loaded:loaded (/usr/lib/systemd/system/auditd.service; enabled; vendor preset: enabled)
Active: active (running) since Tues 2020-12-11 12:56:56 EST; 4 weeks 0 days ago

If the audit service is not "active" and "running", this is a finding.

Vulnerability Number

V-244542

Documentable

False

Rule Version

RHEL-08-030181

Severity Override Guidance

Verify the audit service is configured to produce audit records with the following command:

$ sudo systemctl status auditd.service

auditd.service - Security Auditing Service
Loaded:loaded (/usr/lib/systemd/system/auditd.service; enabled; vendor preset: enabled)
Active: active (running) since Tues 2020-12-11 12:56:56 EST; 4 weeks 0 days ago

If the audit service is not "active" and "running", this is a finding.

Check Content Reference

M

Target Key

2921