The 'auditd' service can be configured to send email to a designated account in certain situations. Add or correct the following line in '/etc/audit/auditd.conf' to ensure that administrators are notified via email for those situations: 'action_mail_acct = root' [root/admin] Email sent to the root account is typically aliased to the administrators of the system, who can take appropriate action. oval:org.secpod.oval:def:48268 oval:org.secpod.oval:def:48887 SCAP Repo OVAL Definition 2018-11-08