Detections
Analytics

1.423 ALMA-09-054580

Information

AlmaLinux OS 9 audit system must retain an optimal number of audit records.

GROUP ID: V-269530
RULE ID: SV-269530r1050413

max_log_file (size in megabytes) multiplied by num_logs must make full use of the auditd storage volume (separate to the root partition).

If max_log_file_action is set to ROTATE or KEEP_LOGS then num_logs must be set to a value between 2 and 99.

Solution

Configure AlmaLinux OS 9 to make full use of the auditd storage volume with rotation enabled.

Add or update the following line ("num_logs" can be set to a number between 2 and 99) in the "/etc/audit/auditd.conf" file:

num_logs = 5

See Also

https://workbench.cisecurity.org/benchmarks/27039

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-5b., CCI|CCI-000140, Rule-ID|SV-269530r1050413_rule, STIG-ID|ALMA-09-054580, Vuln-ID|V-269530

Plugin: Unix

Control ID: a3de5a4f5e795cbf39f24329ef667a4f1b5200545f40e205687d72df9fb931e4