Skip to content

4.1.1.2 Ensure auditd service is enabled and active

Audit#

Run the following command to verify auditd is enabled: 

# systemctl is-enabled auditd
enabled

Verify result is "enabled".

Run the following command to verify auditd is active: 

# systemctl is-active auditd
active

Verify result is active

Remediation#

Run the following command to enable and start auditd: 

# systemctl --now enable auditd