4.1.3 Ensure auditing for processes that start prior to auditd is enabled
Information
Audit events need to be captured on processes that start up prior to auditd, so that potential malicious activity cannot go undetected.
Solution
For grub2 based systems edit /etc/default/grub and add audit=1 to GRUB_CMDLINE_LINUX: GRUB_CMDLINE_LINUX='audit=1' Run the following command to update the grub2 configuration: # update-grub