MEDIUM M15: File Deletion Audit P3
Overview
Audits file deletion operations to track when files are removed from the system. Covers rename, renameat, rmdir, unlink, and unlinkat syscalls.
Profile: NIST 800-53 Moderate (rhcos4-moderate)
Compliance Checks
| Check | Description |
|---|---|
file-deletion-events-rename |
Audit file rename operations |
file-deletion-events-renameat |
Audit file renameat operations |
file-deletion-events-rmdir |
Audit directory removal |
file-deletion-events-unlink |
Audit file unlink (delete) |
file-deletion-events-unlinkat |
Audit file unlinkat operations |
Verification
oc debug node/<node> -- chroot /host auditctl -l | grep -E 'rename|rmdir|unlink'