STIGQter: STIG Summary: Red Hat Enterprise Linux 9 Security Technical Implementation Guide Version: 2 Release: 9 Benchmark Date: 01 Jul 2026:

RHEL 9 must take appropriate action when the internal event queue is full.

DISA Rule

SV-258162r1184331_rule

Vulnerability Number

V-258162

Group Title

SRG-OS-000342-GPOS-00133

Rule Version

RHEL-09-653065

Severity

CAT II

CCI(s)

• CCI-001851 - Transfer audit logs per organization-defined frequency to a different system, system component, or media than the system or system component conducting the logging.

Weight

10

Fix Recommendation

Edit the /etc/audit/auditd.conf file and add or update the "overflow_action" option:

overflow_action = syslog

The audit daemon must be restarted for changes to take effect.

Check Contents

Verify that RHEL 9 audit system is configured to take an appropriate action when the internal event queue is full:

$ sudo grep -i overflow_action /etc/audit/auditd.conf

overflow_action = syslog

If the value of the "overflow_action" option is not set to "syslog", "single", "halt" or the line is commented out, ask the system administrator (SA) to indicate how the audit logs are offloaded to a different system or media.

If there is no evidence that the audit system is configured to off-load the audit logs to another system or media and if the overflow action is not set to take appropriate action if the internal event queue becomes full, this is a finding.

Vulnerability Number

V-258162

Documentable

False

Rule Version

RHEL-09-653065

Severity Override Guidance

Verify that RHEL 9 audit system is configured to take an appropriate action when the internal event queue is full:

$ sudo grep -i overflow_action /etc/audit/auditd.conf

overflow_action = syslog

If the value of the "overflow_action" option is not set to "syslog", "single", "halt" or the line is commented out, ask the system administrator (SA) to indicate how the audit logs are offloaded to a different system or media.

If there is no evidence that the audit system is configured to off-load the audit logs to another system or media and if the overflow action is not set to take appropriate action if the internal event queue becomes full, this is a finding.

Check Content Reference

M

Target Key

5551