Configure auditd flush priority
Sets flush = data in /etc/audit/auditd.conf so audit records are written to disk synchronously rather than left in memory.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Audit records held only in memory are lost on a crash, power failure or kernel panic, exactly the moments when an attacker may try to cover their tracks. Setting flush = data forces every audit event's data to be synchronised to the log file on disk, guaranteeing the integrity and completeness of the trail even if the system goes down abruptly.
What Pavois checks
Pavois reads the effective flush directive from /etc/audit/auditd.conf and requires data. This directive controls how aggressively the running daemon syncs records, so the configured value is the authoritative indicator of durability.
describe command('grep -qiE \'^[[:space:]]*flush[[:space:]]*=[[:space:]]*(incremental_async)\b\' /etc/audit/auditd.conf 2>/dev/null && echo ok || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run grep -i '^[[:space:]]*flush' /etc/audit/auditd.conf. Expected output: flush = data (or the stronger sync).
Inspect & investigate
Audit events themselves land in /var/log/audit/audit.log; daemon start/reload and any flush-related warnings appear in journalctl -u auditd.
Remediation
No automated remediation for this rule, apply it manually following the standard.
Impact & precautions
Synchronous flushing adds disk I/O per audit event, which on very busy or write-heavy systems can introduce measurable latency. Precaution: if performance is critical, incremental_async is a documented compromise, but it weakens the durability guarantee. Validate I/O headroom on high-throughput hosts; on standard servers the overhead of data is negligible compared to the integrity it provides.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| NIST | 3.3.1 | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.