Detections
Analytics

AIX7-00-002006 - AIX must produce audit records containing the full-text recording of privileged commands.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.

At a minimum, the organization must audit the full-text recording of privileged commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Reset the audit system with the following command:
# /usr/sbin/audit shutdown

Start the audit system with the following command:
# /usr/sbin/audit start

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_IBM_AIX_7-x_V2R5_STIG.zip

Item Details

References: CAT|II, CCI|CCI-000135, Rule-ID|SV-215240r508663_rule, STIG-ID|AIX7-00-002006, STIG-Legacy|SV-101355, STIG-Legacy|V-91255, Vuln-ID|V-215240

Plugin: Unix

Control ID: 906d62a0d333b4af51a948f551cf552418f39c6aab5e4ba7f07652988b41fd71