Configure auditd Number of Logs Retained
Sets num_logs in /etc/audit/auditd.conf to at least 5 so enough rotated audit log files are retained on disk.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Total audit retention is a product of the per-file size (max_log_file) and the number of files kept (num_logs). If too few files are retained, rotation discards older logs quickly and the trail covers only a short window, insufficient to investigate an incident discovered days later. Keeping at least 5 files preserves enough history for meaningful forensic analysis.
What Pavois checks
Pavois reads the effective num_logs value from /etc/audit/auditd.conf and requires it to be 5 or greater. This number governs how many rotated files the running daemon keeps, so the configured value is the meaningful indicator of retention depth.
describe command('v=$(grep -iE \'^[[:space:]]*num_logs[[:space:]]*=\' /etc/audit/auditd.conf 2>/dev/null | grep -oE \'[0-9]+\' | tail -1); { [ -n "$v" ] && [ "$v" -ge 5 ] && echo ok; } || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run grep -i '^[[:space:]]*num_logs' /etc/audit/auditd.conf. Expected output: a line such as num_logs = 5 with a value of 5 or more.
Inspect & investigate
List the rotated files under /var/log/audit/ (ls -1 /var/log/audit/audit.log*) to confirm the count kept; rotation events appear in journalctl -u auditd.
Remediation
No automated remediation for this rule, apply it manually following the standard.
Impact & precautions
More retained files combined with max_log_file raises the maximum disk footprint of the audit logs (worst case ≈ max_log_file × num_logs). Note that with max_log_file_action = keep_logs, num_logs is effectively ignored and files accumulate indefinitely. Precaution: size the audit partition for the worst case and confirm space_left_action/disk_full_action are set so a full disk is handled gracefully. The change is non-disruptive; reload auditd to apply it.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| NIST | 3.3.1 | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.