Detections
Analytics

6.2.2.2 Ensure audit logs are not automatically deleted

Information

The max_log_file_action setting determines how to handle the audit log file reaching the max file size. A value of keep_logs will rotate the logs but never delete old logs.

In high security contexts, the benefits of maintaining a long audit history exceed the cost of storing the audit history.

Solution

Set the following parameter in /etc/audit/auditd.conf :

max_log_file_action = keep_logs

Impact:

With max_log_file_action = keep_logs, audit logs are rotated but never automatically deleted, so audit log disk usage grows until logs are manually managed. Ensure adequate audit log storage is configured, that the disk-full and low-space handling (see "Ensure system is disabled when audit logs are full" and "Ensure system warns when audit logs are low on space") are in place, and monitor consumption.

See Also

https://workbench.cisecurity.org/benchmarks/27890

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-4, 800-53|AU-11, CSCv7|6.4

Plugin: Unix

Control ID: 80fcb54d73eb0b8d55a87b892770627cc9256dee9957d8aba4748bb0316f3edf