Information
Configuration Level : Level-II
Solution
For 64 bit systems, add the following lines to the /etc/audit/audit.rules file.-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b64 -S clock_settime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change
# Execute the following command to restart auditd
# pkill -P 1-HUP auditdFor 32 bit systems, add the following lines to the /etc/audit/audit.rules file.-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change
# Execute the following command to restart auditd
# pkill -P 1-HUP auditd