STIGQter: STIG Summary: SUSE Linux Enterprise Micro (SLEM) 5 Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Apr 2026:

The audit-audispd-plugins package must be installed on SLEM 5.

DISA Rule

SV-261412r996649_rule

Vulnerability Number

V-261412

Group Title

SRG-OS-000342-GPOS-00133

Rule Version

SLEM-05-653020

Severity

CAT II

CCI(s)

• CCI-001851 - Transfer audit logs per organization-defined frequency to a different system, system component, or media than the system or system component conducting the logging.

Weight

10

Fix Recommendation

Install the "audit-audispd-plugins" package on SLEM 5 by running the following command:

> sudo transactional-update pkg install audit-audispd-plugins

Add or modify the following line in the "/etc/audisp/plugins.d/au-remote.conf" file:

active = yes

Reboot the system:

> sudo reboot

Check Contents

Verify that the "audit-audispd-plugins" package is installed on SLEM 5 with the following command:

> zypper info audit-audispd-plugins | grep Installed
Installed : Yes

If the "audit-audispd-plugins" package is not installed, this is a finding.

Verify the "au-remote" plugin is enabled with the following command:

> sudo grep -i active /etc/audisp/plugins.d/au-remote.conf
active = yes

If "active" is not set to "yes", is commented out, or is missing, this is a finding.

Vulnerability Number

V-261412

Documentable

False

Rule Version

SLEM-05-653020

Severity Override Guidance

Verify that the "audit-audispd-plugins" package is installed on SLEM 5 with the following command:

> zypper info audit-audispd-plugins | grep Installed
Installed : Yes

If the "audit-audispd-plugins" package is not installed, this is a finding.

Verify the "au-remote" plugin is enabled with the following command:

> sudo grep -i active /etc/audisp/plugins.d/au-remote.conf
active = yes

If "active" is not set to "yes", is commented out, or is missing, this is a finding.

Check Content Reference

M

Target Key

5596