STIGQter: STIG Summary: Red Hat Enterprise Linux 10 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

RHEL 10 must periodically flush audit records to disk to ensure that audit records are not lost.

DISA Rule

SV-281111r1166285_rule

Vulnerability Number

V-281111

Group Title

SRG-OS-000051-GPOS-00024

Rule Version

RHEL-10-500125

Severity

CAT II

CCI(s)

• CCI-000154 - Provide the capability to centrally review and analyze audit records from multiple components within the system.

Weight

10

Fix Recommendation

Configure RHEL 10 to flush audit records to disk by adding or updating the following rule in "/etc/audit/rules.d/audit.rules":

freq = 100

Restart the audit daemon with the following command for changes to take effect:

$ sudo service auditd restart

Check Contents

Verify RHEL 10 is configured to flush audit records to disk after every 100 records with the following command:

$ sudo grep freq /etc/audit/auditd.conf
freq = 100

If "freq" is not set to a value of "100" or greater, the value is missing, or the line is commented out, this is a finding.

Vulnerability Number

V-281111

Documentable

False

Rule Version

RHEL-10-500125

Severity Override Guidance

Verify RHEL 10 is configured to flush audit records to disk after every 100 records with the following command:

$ sudo grep freq /etc/audit/auditd.conf
freq = 100

If "freq" is not set to a value of "100" or greater, the value is missing, or the line is commented out, this is a finding.

Check Content Reference

M

Target Key

5733