Description: The audit log directory contains audit log files. Rationale: Audit information includes all information including: audit records, audit settings and audit reports. This information is needed to successfully audit system activity. This information must be protected from unauthorized modification or deletion. If this information were to be compromised, forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve..Remediation: Run the following command to set permission on audit log files:chmod u-x,g-wx,o-rwx [audit log file name from /etc/audit/auditd.conf] Note: audit log file name is a parameter log_file under /etc/audit/auditd.conf file

[Perm]

Run the following command to configure the audit log files to be owned by the root user: chmod g-w,o-rwx [audit log files]