STIGQter: STIG Summary: Oracle Linux 9 Security Technical Implementation Guide Version: 1 Release: 6 Benchmark Date: 01 Jul 2026:

OL 9 must take appropriate action when a critical audit processing failure occurs.

DISA Rule

SV-271590r1091482_rule

Vulnerability Number

V-271590

Group Title

SRG-OS-000046-GPOS-00022

Rule Version

OL09-00-000820

Severity

CAT II

CCI(s)

• CCI-000139 - Alert organization-defined personnel or roles within an organization-defined time period in the event of an audit logging process failure.
• CCI-000140 - Take organization-defined actions upon audit failure include, shutting down the system, overwriting oldest audit records, and stopping the generation of audit records.

Weight

10

Fix Recommendation

Configure OL 9 to shut down when auditing failures occur.

Add the following line to the bottom of the /etc/audit/audit.rules file:

-f 2

Check Contents

Verify that OL 9 audit service is configured to panic on a critical error with the following command:

$ sudo grep "\-f" /etc/audit/audit.rules
-f 2

If the value for "-f" is not "2", and availability is not documented as an overriding concern, this is a finding.

Vulnerability Number

V-271590

Documentable

False

Rule Version

OL09-00-000820

Severity Override Guidance

Verify that OL 9 audit service is configured to panic on a critical error with the following command:

$ sudo grep "\-f" /etc/audit/audit.rules
-f 2

If the value for "-f" is not "2", and availability is not documented as an overriding concern, this is a finding.

Check Content Reference

M

Target Key

5680