STIGQter: STIG Summary: SUSE Linux Enterprise Micro (SLEM) 5 Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Apr 2026:

The information system security officer (ISSO) and system administrator (SA), at a minimum, must be alerted of a SLEM 5 audit processing failure event.

DISA Rule

SV-261424r996679_rule

Vulnerability Number

V-261424

Group Title

SRG-OS-000046-GPOS-00022

Rule Version

SLEM-05-653080

Severity

CAT II

CCI(s)

• CCI-000139 - Alert organization-defined personnel or roles within an organization-defined time period in the event of an audit logging process failure.

Weight

10

Fix Recommendation

Configure the auditd service to notify the administrators in the event of a SLEM 5 audit processing failure.

Add or modify the following lines in the "/etc/audit/auditd.conf " file:

action_mail_acct = root

Check Contents

Verify the system is configured to send email to an account when it needs to notify an administrator with the following command:

> sudo grep action_mail /etc/audit/auditd.conf
action_mail_acct = root

If the value of the "action_mail_acct" keyword is not set to "root" and/or other accounts for security personnel, the returned line is commented out, or the "action_mail_acct" keyword is missing, this is a finding.

Vulnerability Number

V-261424

Documentable

False

Rule Version

SLEM-05-653080

Severity Override Guidance

Verify the system is configured to send email to an account when it needs to notify an administrator with the following command:

> sudo grep action_mail /etc/audit/auditd.conf
action_mail_acct = root

If the value of the "action_mail_acct" keyword is not set to "root" and/or other accounts for security personnel, the returned line is commented out, or the "action_mail_acct" keyword is missing, this is a finding.

Check Content Reference

M

Target Key

5596