Detections
Analytics

1.49 APPL-15-001030

Information

The macOS system must configure audit capacity warning.

GROUP ID: V-268468
RULE ID: SV-268468r1034344

The audit service must be configured to notify the system administrator when the amount of free disk space remaining reaches an organization-defined value.

This rule ensures that the system administrator is notified in advance that action is required to free up more disk space for audit logs.

Satisfies: SRG-OS-000046-GPOS-00022, SRG-OS-000343-GPOS-00134

Solution

Configure the macOS system to require a minimum of 25 percent free disk space for audit record storage with the following command:

/usr/bin/sed -i.bak 's/.*minfree.*/minfree:25/' /etc/security/audit_control; /usr/sbin/audit -s

See Also

https://workbench.cisecurity.org/benchmarks/23761

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-5(1), 800-53|AU-5a., CCI|CCI-000139, CCI|CCI-001855, Rule-ID|SV-268468r1034344_rule, STIG-ID|APPL-15-001030, Vuln-ID|V-268468

Plugin: Unix

Control ID: f6556bbe13942a1369ff0c349ec2fa15bdc77cfdeb75cc0b1305438a89014e0b