STIGQter: STIG Summary: Red Hat Enterprise Linux 9 Security Technical Implementation Guide Version: 2 Release: 9 Benchmark Date: 01 Jul 2026:

RHEL 9 must take appropriate action when a critical audit processing failure occurs.

DISA Rule

SV-258227r1014992_rule

Vulnerability Number

V-258227

Group Title

SRG-OS-000046-GPOS-00022

Rule Version

RHEL-09-654265

Severity

CAT II

CCI(s)

• CCI-000139 - Alert organization-defined personnel or roles within an organization-defined time period in the event of an audit logging process failure.
• CCI-000140 - Take organization-defined actions upon audit failure include, shutting down the system, overwriting oldest audit records, and stopping the generation of audit records.

Weight

10

Fix Recommendation

Configure RHEL 9 to shut down when auditing failures occur.

Add the following line to the bottom of the /etc/audit/rules.d/audit.rules file:

-f 2

Check Contents

Verify the audit service is configured to panic on a critical error with the following command:

$ sudo grep "\-f" /etc/audit/audit.rules

-f 2

If the value for "-f" is not "2", and availability is not documented as an overriding concern, this is a finding.

Vulnerability Number

V-258227

Documentable

False

Rule Version

RHEL-09-654265

Severity Override Guidance

Verify the audit service is configured to panic on a critical error with the following command:

$ sudo grep "\-f" /etc/audit/audit.rules

-f 2

If the value for "-f" is not "2", and availability is not documented as an overriding concern, this is a finding.

Check Content Reference

M

Target Key

5551