SV-260593r958424_rule
V-260593
SRG-OS-000046-GPOS-00022
UBTU-22-653025
CAT III
10
Configure "auditd" service to notify the SA and ISSO in the event of an audit processing failure.
Add or modify the following line in the "/etc/audit/auditd.conf " file:
action_mail_acct = <administrator_email_account>
Note: Change "administrator_email_account" to the email address of the SA and/or ISSO.
Restart the "auditd" service for the changes take effect:
$ sudo systemctl restart auditd.service
Verify that the SA and ISSO are notified in the event of an audit processing failure by using the following command:
Note: An email package must be installed on the system for email notifications to be sent.
$ sudo grep -i action_mail_acct /etc/audit/auditd.conf
action_mail_acct = <administrator_email_account>
If "action_mail_acct" is not set to the email address of the SA and/or ISSO, is commented out, or is missing, this is a finding.
V-260593
False
UBTU-22-653025
Verify that the SA and ISSO are notified in the event of an audit processing failure by using the following command:
Note: An email package must be installed on the system for email notifications to be sent.
$ sudo grep -i action_mail_acct /etc/audit/auditd.conf
action_mail_acct = <administrator_email_account>
If "action_mail_acct" is not set to the email address of the SA and/or ISSO, is commented out, or is missing, this is a finding.
M
5594