Detections
Analytics

1.404 ALMA-09-052380

Information

AlmaLinux OS 9 must take appropriate action when the internal event queue is full.

GROUP ID: V-269511
RULE ID: SV-269511r1050394

The audit system should have an action setup in the event the internal event queue becomes full so that no data is lost.

Solution

Edit the /etc/audit/auditd.conf file and add or update the "overflow_action" option:

overflow_action = SYSLOG

The audit daemon must be restarted for changes to take effect.

See Also

https://workbench.cisecurity.org/benchmarks/27039

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-4(1), CCI|CCI-001851, Rule-ID|SV-269511r1050394_rule, STIG-ID|ALMA-09-052380, Vuln-ID|V-269511

Plugin: Unix

Control ID: d5ee73fab30529b1324e98b5d0ff4602ac229845f866a102ba57003f70680b29