STIGQter: STIG Summary: Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide Version: 1 Release: 7 Benchmark Date: 01 Jul 2026:

AlmaLinux OS 9 must take appropriate action when a critical audit processing failure occurs.

DISA Rule

SV-269527r1050410_rule

Vulnerability Number

V-269527

Group Title

SRG-OS-000047-GPOS-00023

Rule Version

ALMA-09-054250

Severity

CAT II

CCI(s)

• CCI-000140 - Take organization-defined actions upon audit failure include, shutting down the system, overwriting oldest audit records, and stopping the generation of audit records.

Weight

10

Fix Recommendation

Configure AlmaLinux OS 9 to halt the system when auditing failures occur.

Add the following line to the /etc/audit/audit.rules file:

-f 2

Reload the audit rules with the following command:

auditctl -R /etc/audit/audit.rules

Check Contents

Verify the auditd service is configured to panic on a critical error with the following command:

$ auditctl -s

failure 2

A number of parameters will display. If the value for "failure" is not "2", and availability is not documented as an overriding concern, this is a finding.

Vulnerability Number

V-269527

Documentable

False

Rule Version

ALMA-09-054250

Severity Override Guidance

Verify the auditd service is configured to panic on a critical error with the following command:

$ auditctl -s

failure 2

A number of parameters will display. If the value for "failure" is not "2", and availability is not documented as an overriding concern, this is a finding.

Check Content Reference

M

Target Key

5664