documentation_complete: true


title: 'Shutdown System When Auditing Failures Occur'

description: |-
    If the <tt>auditd</tt> daemon is configured to use the
    <tt>augenrules</tt> program to read audit rules during daemon startup (the
    default), add the following line to to the bottom of a file with suffix
    <tt>.rules</tt> in the directory <tt>/etc/audit/rules.d</tt>:
    <pre>-f {{{ xccdf_value("var_audit_failure_mode") }}}</pre>
    If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
    utility to read audit rules during daemon startup, add the following line to the
    bottom of the <tt>/etc/audit/audit.rules</tt> file:
    <pre>-f {{{ xccdf_value("var_audit_failure_mode") }}}</pre>

rationale: |-
    It is critical for the appropriate personnel to be aware if a system
    is at risk of failing to process audit logs as required. Without this
    notification, the security personnel may be unaware of an impending failure of
    the audit capability, and system operation may be adversely affected.
    <br /><br />
    Audit processing failures include software/hardware errors, failures in the
    audit capturing mechanisms, and audit storage capacity being reached or
    exceeded.

severity: medium

identifiers:
    cce@rhel8: CCE-80744-6
    cce@rhel9: CCE-83709-6
    cce@rhel10: CCE-87352-1
    cce@sle15: CCE-85774-8
    cce@sle16: CCE-95811-6

references:
    cis-csc: 1,14,15,16,3,5,6
    cobit5: APO11.04,BAI03.05,DSS05.04,DSS05.07,MEA02.01
    cui: 3.3.1,3.3.4
    hipaa: 164.308(a)(1)(ii)(D),164.308(a)(3)(ii)(A),164.308(a)(5)(ii)(C),164.312(a)(2)(i),164.312(b),164.312(d),164.312(e)
    isa-62443-2009: 4.3.3.3.9,4.3.3.5.8,4.3.4.4.7,4.4.2.1,4.4.2.2,4.4.2.4
    isa-62443-2013: 'SR 2.10,SR 2.11,SR 2.12,SR 2.8,SR 2.9'
    iso27001-2013: A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1
    nist: AU-5(b),SC-24,CM-6(a)
    nist-csf: PR.PT-1
    srg: SRG-OS-000046-GPOS-00022,SRG-OS-000047-GPOS-00023
    stigid@ol7: OL07-00-030010

ocil_clause: 'the system is not configured to shutdown on auditd failures'

ocil: |-
    To verify that the system will shutdown when <tt>auditd</tt> fails,
    run the following command:
    <pre>$ sudo grep "\-f {{{ xccdf_value("var_audit_failure_mode") }}}" /etc/audit/audit.rules</pre>
    The output should contain:
    <pre>-f {{{ xccdf_value("var_audit_failure_mode") }}}</pre>

fixtext: |-
    Configure {{{ full_name }}} to shutdown when auditing failures occur.

    If the auditd daemon is configured to use the augenrules program to read
    audit rules during daemon startup (the default), add the following line to
    the bottom of "/etc/audit/rules.d/immutable.rules":
    -f {{{ xccdf_value("var_audit_failure_mode") }}}

    If the auditd daemon is configured to use the auditctl utility to read
    audit rules during daemon startup, add the following line to the
    bottom of the /etc/audit/audit.rules file:
    -f {{{ xccdf_value("var_audit_failure_mode") }}}

srg_requirement: The {{{ full_name }}} system must shut down when an audit processing failure occurs.
