Detections
Analytics

1.412 ALMA-09-053260

Information

AlmaLinux OS 9 must take action when allocated audit record storage volume reaches 95 percent of the audit record storage capacity.

GROUP ID: V-269519
RULE ID: SV-269519r1050402

If security personnel are not notified immediately when storage volume reaches 75 percent usage, they are unable to plan for audit record storage capacity expansion.

Solution

Configure AlmaLinux OS 9 to initiate an action when allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity by adding/modifying the following line in the /etc/audit/auditd.conf file.

admin_space_left = 5%

See Also

https://workbench.cisecurity.org/benchmarks/27039

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-5(1), CCI|CCI-001855, Rule-ID|SV-269519r1050402_rule, STIG-ID|ALMA-09-053260, Vuln-ID|V-269519

Plugin: Unix

Control ID: 711720b57bba082d3e016e43357d922d2220000caca66f634c267a7e01b2f0a8