OVALFileLinker from SCAP Security Guide ssg: [0, 1, 80], python: 3.10.12 5.11.2 2026-01-21T21:18:20 System Audit Logs Must Have Mode 0640 or Less Permissive Ubuntu 22.04 Checks for correct permissions for all audit log files. 'log_file' Not Set In /etc/audit/auditd.conf Ubuntu 22.04 Verify 'log_file' is not set in /etc/audit/auditd.conf. 'log_group' Not Set To 'root' In /etc/audit/auditd.conf Ubuntu 22.04 Verify 'log_group' is not set to 'root' in /etc/audit/auditd.conf. oval:ssg-state_not_mode_0600:ste:1 /var/log/audit ^.*$ oval:ssg-state_not_mode_0600:ste:1 oval:ssg-state_not_mode_0640:ste:1 /var/log/audit ^.*$ oval:ssg-state_not_mode_0640:ste:1 /etc/audit/auditd.conf ^(log_file\s*=\s*.*)$ 1 /etc/audit/auditd.conf ^[ ]*log_group[ ]+=[ ]+root[ ]*$ 1 /etc/audit/auditd.conf ^[ ]*log_group[ ]+=.*$ 1 true true true true true true true true true true true true true true true true true true true