Detections
Analytics

1.48 APPL-26-001030

Information

The macOS system must configure audit capacity warning.

GROUP ID: V-277075
RULE ID: SV-277075r1148677

The audit service must be configured to notify the system administrator when the amount of free disk space remaining reaches an organization-defined value.

This rule ensures that the system administrator is notified in advance that action is required to free up more disk space for audit logs.

Satisfies: SRG-OS-000046-GPOS-00022, SRG-OS-000343-GPOS-00134

Solution

Configure the macOS system to require a minimum of 25 percent free disk space for audit record storage with the following command:

/usr/bin/sed -i.bak 's/.*minfree.*/minfree:25/' /etc/security/audit_control; /usr/sbin/audit -s

See Also

https://workbench.cisecurity.org/benchmarks/26538

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-5(1), 800-53|AU-5a., CCI|CCI-000139, CCI|CCI-001855, Rule-ID|SV-277075r1148677_rule, STIG-ID|APPL-26-001030, Vuln-ID|V-277075

Plugin: Unix

Control ID: 355cff3128c91ddc079945ba4d89203880e6acdc2261b0aeac11659c8364a968