Detections
Analytics

1.77 AZLX-23-002030

Information

Amazon Linux 2023 must take appropriate action when the internal event queue is full.

GROUP ID: V-274070RULE ID: SV-274070r1120198

The audit system should have an action setup in the event the internal event queue becomes full so that no data is lost. Information stored in one location is vulnerable to accidental or incidental deletion or alteration.

Solution

Configure Amazon Linux 2023 so that the audit system takes an appropriate action when the internal event queue is full.

Edit the /etc/audit/auditd.conf file and add or update the "overflow_action" option:

overflow_action = syslog

The audit daemon must be restarted for changes to take effect.

See Also

https://workbench.cisecurity.org/benchmarks/26107

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-4(1), CAT|II, CCI|CCI-001851, Rule-ID|SV-274070r1120198_rule, STIG-ID|AZLX-23-002030, Vuln-ID|V-274070

Plugin: Unix

Control ID: 3ed699b28b065b0571c589f3ad17901621d0fe41ae508801bbfdebb405e3303c