id: audit_retention_configure
title: Configure Audit Retention to $ODV
discussion: |
  The audit service _MUST_ be configured to require records be kept for a organizational defined value before deletion, unless the system uses a central audit record storage facility.

  When "expire-after" is set to "$ODV", the audit service will not delete audit logs until the log data criteria is met.
check: |
  /usr/bin/awk -F: '/expire-after/{print $2}' /etc/security/audit_control
result:
  string: $ODV
fix: |
  [source,bash]
  ----
  /usr/bin/sed -i.bak 's/^expire-after.*/expire-after:$ODV/' /etc/security/audit_control; /usr/sbin/audit -s
  ----
references:
  cce:
    - CCE-95130-1
  cci:
    - CCI-001849
  800-53r5:
    - AU-11
    - AU-4
  800-53r4:
    - AU-4
    - AU-11
  srg:
    - SRG-OS-000341-GPOS-00132
  disa_stig:
    - APPL-26-001029
  cis:
    benchmark:
      - 3.4 (level 1)
    controls v8:
      - 8.1
      - 8.3
  cmmc:
    - AU.L2-3.3.1
  800-171r3:
    - 03.03.03
  bio:
    - 8.18.02
macOS:
  - '26.0'
odv:
  hint: See man audit_control for possible values.
  recommended: 7d
  cis_lvl1: 60d OR 5G
  cis_lvl2: 60d OR 5G
  stig: 7d
  nlmapgov_base: 180d
  nlmapgov_plus: 180d
tags:
  - 800-171
  - 800-53r5_privacy
  - 800-53r4_low
  - 800-53r4_moderate
  - 800-53r4_high
  - 800-53r5_low
  - 800-53r5_moderate
  - 800-53r5_high
  - cis_lvl1
  - cis_lvl2
  - cisv8
  - cnssi-1253_low
  - cnssi-1253_high
  - cmmc_lvl2
  - stig
  - cnssi-1253_moderate
  - nlmapgov_base
  - nlmapgov_plus
severity: low
mobileconfig: false
mobileconfig_info:
