STIGQter: STIG Summary: Red Hat Enterprise Linux 10 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

RHEL 10 must take appropriate action when a critical audit processing failure occurs.

DISA Rule

SV-281103r1166261_rule

Vulnerability Number

V-281103

Group Title

SRG-OS-000046-GPOS-00022

Rule Version

RHEL-10-500035

Severity

CAT II

CCI(s)

• CCI-000139 - Alert organization-defined personnel or roles within an organization-defined time period in the event of an audit logging process failure.

Weight

10

Fix Recommendation

Configure RHEL 10 to shut down when auditing failures occur.

Add the following line to the bottom of the "/etc/audit/rules.d/audit.rules" file:

-f 2

Check Contents

Verify the RHEL 10 audit service is configured to panic on a critical error with the following command:

$ sudo grep "\-f" /etc/audit/audit.rules
-f 2

If the value for "-f" is not "2", and availability is not documented as an overriding concern, this is a finding.

Vulnerability Number

V-281103

Documentable

False

Rule Version

RHEL-10-500035

Severity Override Guidance

Verify the RHEL 10 audit service is configured to panic on a critical error with the following command:

$ sudo grep "\-f" /etc/audit/audit.rules
-f 2

If the value for "-f" is not "2", and availability is not documented as an overriding concern, this is a finding.

Check Content Reference

M

Target Key

5733