STIGQter: STIG Summary: Red Hat Enterprise Linux 9 Security Technical Implementation Guide Version: 2 Release: 9 Benchmark Date: 01 Jul 2026:

RHEL 9 must periodically flush audit records to disk to prevent the loss of audit records.

DISA Rule

SV-258168r958428_rule

Vulnerability Number

V-258168

Group Title

SRG-OS-000051-GPOS-00024

Rule Version

RHEL-09-653095

Severity

CAT II

CCI(s)

• CCI-000154 - Provide the capability to centrally review and analyze audit records from multiple components within the system.

Weight

10

Fix Recommendation

Configure RHEL 9 to flush audit to disk by adding or updating the following rule in "/etc/audit/auditd.conf":

freq = 100

The audit daemon must be restarted for the changes to take effect.

Check Contents

Verify that audit system is configured to flush to disk after every 100 records with the following command:

$ sudo grep freq /etc/audit/auditd.conf

freq = 100

If "freq" isn't set to a value between "1" and "100", the value is missing, or the line is commented out, this is a finding.

Vulnerability Number

V-258168

Documentable

False

Rule Version

RHEL-09-653095

Severity Override Guidance

Verify that audit system is configured to flush to disk after every 100 records with the following command:

$ sudo grep freq /etc/audit/auditd.conf

freq = 100

If "freq" isn't set to a value between "1" and "100", the value is missing, or the line is commented out, this is a finding.

Check Content Reference

M

Target Key

5551