
<def-group>
  <definition class="compliance" id="auditd_freq" version="1">
    <metadata>
        <title>Set number of records to cause an explicit flush to audit logs</title>
        
    <affected family="unix">
    <platform>Ubuntu 22.04</platform>
    </affected>
        <description>Ensure 'freq' is configured with value configured through XCCDF variable var_auditd_freq' in /etc/audit/auditd.conf</description>
    </metadata>
    <criteria comment="auditd is configured correctly"
    operator="OR"><criterion comment="Check the freq in /etc/audit/auditd.conf"
  test_ref="test_auditd_freq" />
    </criteria>
  </definition>

  
  
<external_variable comment="Variable defining the value the argument should have" datatype="int" id="var_auditd_freq" version="1" />

  

  
<ind:textfilecontent54_test check="all" check_existence="all_exist"
  comment="tests the value of freq setting in the /etc/audit/auditd.conf file"
  id="test_auditd_freq" version="1">
  <ind:object object_ref="obj_auditd_freq" />
  <ind:state state_ref="state_auditd_freq" />
</ind:textfilecontent54_test>
  
<ind:textfilecontent54_object id="obj_auditd_freq" version="1">
  <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
  <ind:pattern operation="pattern match">^[ \t]*(?i)freq(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind:pattern>
  <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
</ind:textfilecontent54_object><ind:textfilecontent54_state id="state_auditd_freq" version="1">
  <ind:subexpression datatype="int" operation="equals" var_ref="var_auditd_freq" />
</ind:textfilecontent54_state>

</def-group>