Detections
Analytics

6.2.2.3 Ensure system is disabled when audit logs are full

Information

The disk_full_action parameter sets the action auditd takes when the partition holding the audit log files has no free space. The disk_error_action parameter sets the action auditd takes when an error is detected on that partition.

In high security contexts, the risk of detecting unauthorized access or nonrepudiation exceeds the benefit of the system's availability.

Solution

Set one of the following parameters in /etc/audit/auditd.conf depending on your local security policies.

disk_full_action = <halt|single>
disk_error_action = <syslog|single|halt>

Example:

disk_full_action = halt
disk_error_action = halt

Impact:

disk_full_action parameter:

 - Set to halt - the auditd daemon will shutdown the system when the disk partition containing the audit logs becomes full.
 - Set to single - the auditd daemon will put the computer system in single user mode when the disk partition containing the audit logs becomes full.

disk_error_action parameter:

 - Set to halt - the auditd daemon will shutdown the system when an error is detected on the partition that holds the audit log files.
 - Set to single - the auditd daemon will put the computer system in single user mode when an error is detected on the partition that holds the audit log files.
 - Set to syslog - the auditd daemon will issue no more than 5 consecutive warnings to syslog when an error is detected on the partition that holds the audit log files.

See Also

https://workbench.cisecurity.org/benchmarks/27890

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-4, 800-53|AU-5b., CSCv7|6.4

Plugin: Unix

Control ID: cae49db9e62c8d69fdb78106bd9ce0f3f9affdd2ff570790208b3f0fac399bac