documentation_complete: true

prodtype: rhel7

title: 'Shutdown System When Auditing Failures Occur'

description: |-
    If the <tt>auditd</tt> daemon is configured to use the
    <tt>augenrules</tt> program to read audit rules during daemon startup (the
    default), add the following line to a file with suffix <tt>.rules</tt> in the
    directory <tt>/etc/audit/rules.d</tt>:
    <pre>-f 2</pre>
    If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
    utility to read audit rules during daemon startup, add the following line to the
    top of the <tt>/etc/audit/audit.rules</tt> file:
    <pre>-f 2</pre>

rationale: |-
    It is critical for the appropriate personnel to be aware if a system
    is at risk of failing to process audit logs as required. Without this
    notification, the security personnel may be unaware of an impending failure of
    the audit capability, and system operation may be adversely affected.
    <br /><br />
    Audit processing failures include software/hardware errors, failures in the
    audit capturing mechanisms, and audit storage capacity being reached or
    exceeded.

severity: medium

identifiers:
    cce@rhel7: 80381-7

references:
    cui: 3.3.1,3.3.4
    disa: 139
    hipaa: 164.308(a)(1)(ii)(D),164.308(a)(3)(ii)(A),164.308(a)(5)(ii)(C),164.312(a)(2)(i),164.312(b),164.312(d),164.312(e)
    nist: AU-5,AU-5(a)
    srg: SRG-OS-000046-GPOS-00022,SRG-OS-000047-GPOS-00023
    stigid@rhel7: "030010"

ocil_clause: 'the system is not configured to shutdown on auditd failures'

ocil: |-
    To verify that the system will shutdown when <tt>auditd</tt> fails,
    run the following command:
    <pre>$ sudo grep "\-f 2" /etc/audit/audit.rules</pre>
    The output should contain:
    <pre>-f 2</pre>
