Set number of records to cause an explicit flush to audit logs
Sets freq in /etc/audit/auditd.conf to at least 50, bounding how many records auditd may buffer before forcing a flush to disk.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
Why this rule matters
The freq value caps how many audit records may accumulate in memory before being flushed to disk. If freq is unset or too high, a crash or power loss can discard a large batch of as-yet-unwritten events, increasing the risk of audit loss precisely when an incident occurs. Keeping freq at 50 or below limits the window of records exposed to loss.
What Pavois checks
Pavois reads the effective freq value from /etc/audit/auditd.conf and requires it to be 50 or greater (matching the SSG baseline for this rule). Because it governs the running daemon's flush cadence, the configured value is the meaningful indicator.
describe command('v=$(grep -iE \'^[[:space:]]*freq[[:space:]]*=\' /etc/audit/auditd.conf 2>/dev/null | grep -oE \'[0-9]+\' | tail -1); { [ -n "$v" ] && [ "$v" -ge 50 ] && echo ok; } || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run grep -i '^[[:space:]]*freq' /etc/audit/auditd.conf. Expected output: a line such as freq = 50 with a value of 50 or more.
Inspect & investigate
Audit events are recorded in /var/log/audit/audit.log; daemon configuration reloads and warnings are visible via journalctl -u auditd.
Remediation
No automated harden plan is defined for this rule, so it must be applied manually: set freq = 50 (or higher) in /etc/audit/auditd.conf and reload auditd (service auditd reload).
Pavois applies this with its own harden engine, the plan below, not a shell script:
| file | /etc/audit/auditd.conf |
|---|---|
| key | freq |
| resource | conf_line |
| service | auditd |
| value | 100 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
More frequent flushing means more disk writes, a minor I/O overhead on busy systems. The setting is interpreted by auditd only when flush is set to incremental/incremental_async; with flush = data or sync it has no effect. Precaution: none significant for availability, a too-low value only trades a little I/O for durability. Reload, do not stop, auditd to avoid a gap in coverage.