Detections
Analytics

1.421 ALMA-09-054360

Information

AlmaLinux OS 9 audit system must make full use of the audit storage space.

GROUP ID: V-269528
RULE ID: SV-269528r1050411

max_log_file (size in megabytes) multiplied by num_logs must make full use of the auditd storage volume (separate to the root partition).

If max_log_file_action is set to ROTATE or KEEP_LOGS then max_log_file must be set to a value that makes the most use of the storage available.

Solution

Configure AlmaLinux OS 9 to make full use of the auditd storage volume with rotation enabled.

Add or update the following line in the "/etc/audit/auditd.conf" file to a value large enough to make efficient use of the auditd storage volume:

max_log_file = 100

See Also

https://workbench.cisecurity.org/benchmarks/27039

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-5b., CCI|CCI-000140, Rule-ID|SV-269528r1050411_rule, STIG-ID|ALMA-09-054360, Vuln-ID|V-269528

Plugin: Unix

Control ID: aacda04fe1ee540be3ea5c90310571f18f7d31e6b0f1075c62e3b7bbb8decf2e