documentation_complete: true

title: 'Include Local Events in Audit Logs'

description: |-
    To configure Audit daemon to include local events in Audit logs, set
    <tt>local_events</tt> to <tt>yes</tt> in <tt>/etc/audit/auditd.conf</tt>.
    This is the default setting.

rationale: |-
    If option <tt>local_events</tt> isn't set to <tt>yes</tt> only events from
    network will be aggregated.

severity: medium

identifiers:
    cce@rhcos4: CCE-82509-1
    cce@rhel8: CCE-82233-8
    cce@rhel9: CCE-83682-5
    cce@rhel10: CCE-88064-1

references:
    nist: CM-6
    srg: SRG-OS-000062-GPOS-00031,SRG-OS-000480-GPOS-00227
    stigid@ol8: OL08-00-030061

ocil_clause: local_events isn't set to yes

ocil: |-
    To verify that Audit Daemon is configured to include local events, run the
    following command:
    <pre>$ sudo grep local_events /etc/audit/auditd.conf</pre>
    The output should return the following:
    <pre>local_events = yes</pre>

fixtext: |-
    {{{ fixtext_audit_configuration(param="local_events", value="yes") | indent(4) }}}

srg_requirement: 'The {{{ full_name }}} must audit local events.'

template:
    name: auditd_lineinfile
    vars:
        missing_parameter_pass: 'false'
        parameter: local_events
        rule_id: auditd_local_events
        value: 'yes'
