Set type of computer node name logging in audit logs
Sets name_format = hostname in /etc/audit/auditd.conf so each audit record carries the originating machine's name.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
When name_format is left at its default none, audit records contain no machine identifier. Once logs from many hosts are aggregated into a central SIEM or log server, events become impossible to attribute to the system that produced them, crippling correlation and incident response. Setting hostname (or fqd/numeric) stamps each record with the node name so cross-host analysis remains accurate.
What Pavois checks
Pavois reads the effective name_format directive from /etc/audit/auditd.conf and requires hostname. This value determines what node identifier the running daemon stamps on records, so the configured directive is the authoritative indicator.
describe command('grep -qiE \'^[[:space:]]*name_format[[:space:]]*=[[:space:]]*(hostname)\b\' /etc/audit/auditd.conf 2>/dev/null && echo ok || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run grep -i '^[[:space:]]*name_format' /etc/audit/auditd.conf. Expected output: name_format = hostname. Audit records will then include a node= field.
Inspect & investigate
Inspect /var/log/audit/audit.log, once applied, records carry a node=<hostname> field. Daemon reload appears in journalctl -u auditd.
Remediation
No automated harden plan is defined for this rule, so it must be applied manually: set name_format = hostname in /etc/audit/auditd.conf and reload auditd (service auditd reload).
Pavois applies this with its own harden engine, the plan below, not a shell script:
| file | /etc/audit/auditd.conf |
|---|---|
| key | name_format |
| resource | conf_line |
| service | auditd |
| value | hostname |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Adding a node= field changes the record format: downstream parsers, SIEM rules or log-shipping pipelines that assume the old layout may need adjustment. Precaution: confirm your log collector handles the node= field, and if you choose user set name to a meaningful, stable value. The change is non-disruptive to the host itself; just reload auditd to apply it.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| PCI DSS | 10.2.2 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.