Detections
Analytics

1.114 AZLX-23-002220

Information

Amazon Linux 2023 must off-load audit records onto a different system in the event the audit storage volume is full.

GROUP ID: V-274107RULE ID: SV-274107r1120309

Information stored in one location is vulnerable to accidental or incidental deletion or alteration.

Off-loading is a common process in information systems with limited audit storage capacity.

Solution

Configure Amazon Linux 2023 to off-load audit logs in the event the audit storage volume becomes full.

Add or update the following line (depending on configuration "disk_full_action" can be set to "SYSLOG" or "SINGLE" depending on configuration) in "/etc/audit/auditd.conf" file:

disk_full_action = SYSLOG

See Also

https://workbench.cisecurity.org/benchmarks/26107

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-4(1), CAT|II, CCI|CCI-001851, Rule-ID|SV-274107r1120309_rule, STIG-ID|AZLX-23-002220, Vuln-ID|V-274107

Plugin: Unix

Control ID: 846b8cc9a70649e18bdba09cbcbb3281f9fded28dba0332e859d5248d446860a