documentation_complete: true

title: 'Write Audit Logs to the Disk'

description: |-
    To configure Audit daemon to write Audit logs to the disk, set
    <tt>write_logs</tt> to <tt>yes</tt> in <tt>/etc/audit/auditd.conf</tt>.
    This is the default setting.

rationale: |-
    If <tt>write_logs</tt> isn't set to <tt>yes</tt>, the Audit logs will
    not be written to the disk.

severity: medium

identifiers:
    cce@rhcos4: CCE-82510-9
    cce@rhel8: CCE-82366-6
    cce@rhel9: CCE-83705-4
    cce@rhel10: CCE-88724-0

references:
    nist: CM-6
    srg: SRG-OS-000480-GPOS-00227

ocil_clause: write_logs isn't set to yes

ocil: |-
    To verify that Audit Daemon is configured to write logs to the disk, run the
    following command:
    <pre>$ sudo grep write_logs /etc/audit/auditd.conf</pre>
    The output should return the following:
    <pre>write_logs = yes</pre>

fixtext: |-
    {{{ fixtext_audit_configuration(param="write_logs", value="yes") | indent(4) }}}

srg_requirement: '{{{ full_name }}} must write audit logs to disk.'

template:
    name: auditd_lineinfile
    vars:
        missing_parameter_pass: 'true'
        parameter: write_logs
        rule_id: auditd_write_logs
        value: 'yes'
