Ensure the audit Subsystem is installed
Ensures the audit package (the Linux Audit daemon auditd and its tools) is installed so the kernel can record security-relevant events.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
auditd is the kernel-backed accounting daemon that records system calls, logins, privilege use and file accesses, providing the immutable trail needed for incident response and compliance. Without it installed there is no authoritative record of who did what, investigations are blind and the host fails CIS, ANSSI BP-028 R33, PCI-DSS 10 and NIST AU-2/AU-12 logging requirements.
What Pavois checks
Pavois asks the package database (via dpkg/rpm) whether audit is installed using the InSpec package resource. Querying the effective package state confirms the daemon binaries are present, which is the prerequisite for every downstream audit-rule control.
describe package('auditd') do
it { should be_installed }
endHow to verify it is applied
Run dpkg -s audit (Debian/Ubuntu, the package is auditd) or rpm -q audit (RHEL), expected the package present. Confirm the daemon is running with systemctl is-active auditd and rules are loaded with auditctl -l.
Inspect & investigate
dpkg -l auditd/rpm -q auditconfirm installation.- All audit activity is written to
/var/log/audit/audit.log; daemon start/stop and rule-load messages also appear injournalctl -u auditd. Note:ausearchcan return false "no matches", when in doubt, grep the raw log forkey="<key>".
Remediation
Pavois's harden plan installs the audit package (package resource, install action) with pavois harden apply. Installing it enables auditd; the actual audit rules (watches, syscall rules, immutable -e 2 flag) are applied by the separate audit-domain controls.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | auditd |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Installing auditd is low-risk but it begins recording immediately, so plan for log volume and disk usage, a busy host with broad rules can fill /var/log/audit quickly. Configure max_log_file, num_logs and a sane space_left_action/disk_full_action; setting these to halt without monitoring can stop the host. Avoid enabling immutable mode (-e 2) until rules are finalized, since it requires a reboot to change.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R33 | direct | 2.0 | high |
| CIS | 10.2.1, 6.2.1.1, 6.3.1.1 | direct | per OS, see the benchmark table | high |
| NIST | AC-7(a), AU-12(2), AU-14, AU-2(a), AU-7(1), AU-7(2), CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 10.2.1 | supporting | 4.0.1 | medium |
| DISA STIG | UBTU-22-653010, UBTU-24-100400 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.