STIGQter: STIG Summary: Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide Version: 1 Release: 7 Benchmark Date: 01 Jul 2026:

AlmaLinux OS 9 must periodically flush audit records to disk to prevent the loss of audit records.

DISA Rule

SV-269531r1050414_rule

Vulnerability Number

V-269531

Group Title

SRG-OS-000051-GPOS-00024

Rule Version

ALMA-09-054690

Severity

CAT II

CCI(s)

• CCI-000154 - Provide the capability to centrally review and analyze audit records from multiple components within the system.

Weight

10

Fix Recommendation

Configure AlmaLinux OS 9 to flush audit to disk by adding or updating the following rule in "/etc/audit/auditd.conf":

freq = 100

The audit daemon must be restarted for the changes to take effect.

Check Contents

Verify that audit system is configured to flush to disk after every 100 records with the following command:

$ grep freq /etc/audit/auditd.conf

freq = 100

If "freq" is not set to a value between "1" and "100", the value is missing, or the line is commented out, this is a finding.

Vulnerability Number

V-269531

Documentable

False

Rule Version

ALMA-09-054690

Severity Override Guidance

Verify that audit system is configured to flush to disk after every 100 records with the following command:

$ grep freq /etc/audit/auditd.conf

freq = 100

If "freq" is not set to a value between "1" and "100", the value is missing, or the line is commented out, this is a finding.

Check Content Reference

M

Target Key

5664