Ensure the default plugins for the audit dispatcher are installed
Ensures the audispd-plugins package is installed so audit events can be dispatched and forwarded to a remote log host.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Audit records kept only on the local host are vulnerable to deletion or alteration once that host is compromised, and limited local storage causes log rotation to drop evidence. audispd-plugins provides the dispatcher plugins (notably au-remote/audisp-remote) that off-load audit events to a central, tamper-resistant collector, a requirement of CIS and PCI-DSS 10.5.3 for protecting the audit trail.
What Pavois checks
Pavois asks the package database (via dpkg/rpm) whether audispd-plugins is installed using the InSpec package resource. Checking the effective package state confirms the dispatcher plugins are actually present, regardless of how auditd itself was configured.
describe package('audispd-plugins') do
it { should be_installed }
endHow to verify it is applied
Run dpkg -s audispd-plugins (Debian/Ubuntu) or rpm -q audispd-plugins (RHEL), expected the package present. Confirm the remote plugin exists at /etc/audit/plugins.d/au-remote.conf and that audisp-remote is on the system.
Inspect & investigate
dpkg -l audispd-plugins/rpm -q audispd-pluginsconfirm installation.- Dispatcher and forwarding activity appears in
journalctl -u auditdand in/var/log/audit/audit.log; remote-plugin connection errors are logged there too.
Remediation
Pavois's harden plan installs the audispd-plugins package (package resource, install action) with pavois harden apply. Installing it makes the plugins available; forwarding still requires editing /etc/audit/plugins.d/au-remote.conf (set active = yes and the remote_server) and restarting auditd.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | audispd-plugins |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Installing the package is non-disruptive and does not enable forwarding by itself. When you later activate the remote plugin, ensure the collector is reachable and sized correctly, if audisp-remote is set to a blocking overflow_action and the network or collector fails, auditd can stall and, with disk_full_action/network_failure_action = halt, even take the host down. Validate connectivity and choose a safe failure action before enabling.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 10.3.3, 6.2.1.1, 6.3.1.1 | direct | per OS, see the benchmark table | high |
| PCI DSS | 10.3.3 | supporting | 4.0.1 | medium |
| DISA STIG | UBTU-22-653020, UBTU-24-100450 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.