Detections
Analytics

6.2.2.4 Ensure system warns when audit logs are low on space

Information

The space_left_action parameter sets the action auditd takes when free space on the partition holding the audit log files drops below the space_left threshold. The admin_space_left_action parameter sets the action auditd takes when free space drops below the lower admin_space_left threshold.

In high security contexts, the risk of detecting unauthorized access or nonrepudiation exceeds the benefit of the system's availability.

Solution

- Set the space_left_action parameter in /etc/audit/auditd.conf to email, exec, single, or halt :

space_left_action = email

 - Set the admin_space_left_action parameter in /etc/audit/auditd.conf to single or halt :

admin_space_left_action = single

Note: A Mail Transfer Agent (MTA) must be installed and configured to use space_left_action = email.

Impact:

If space_left_action is set to email, a Mail Transfer Agent must be available to deliver the low-space warning. If space_left_action or admin_space_left_action is set to single, auditd puts the system in single user mode when the corresponding threshold is reached; if set to halt, auditd shuts the system down. Choose actions consistent with your availability requirements.

See Also

https://workbench.cisecurity.org/benchmarks/27890

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-4, 800-53|AU-5, CSCv7|6.4

Plugin: Unix

Control ID: 87009d34af846a423fb1292ea4dcca4dad90aa2da1c4ee8083cd6f5308e67a0a