Detections
Analytics

1.80 AZLX-23-002045

Information

Amazon Linux 2023 must take action when allocated audit record storage volume reaches 95 percent of the audit record storage capacity.

GROUP ID: V-274073RULE ID: SV-274073r1120207

If action is not taken when storage volume reaches 95 percent utilization, the auditing system may fail when the storage volume reaches capacity.

Solution

Configure Amazon Linux 2023 to initiate an action when allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity by adding/modifying the following line in the /etc/audit/auditd.conf file.

admin_space_left = 5%

See Also

https://workbench.cisecurity.org/benchmarks/26107

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-5(1), CAT|II, CCI|CCI-001855, Rule-ID|SV-274073r1120207_rule, STIG-ID|AZLX-23-002045, Vuln-ID|V-274073

Plugin: Unix

Control ID: 1df5c62e73599709f3be1b646af1fe8d9e029aed3f4d162f432e907790a374eb