Detections
Analytics

1.415 ALMA-09-053590

Information

AlmaLinux OS 9 must notify the system administrator (SA) and information system security officer (ISSO) (at a minimum) when allocated audit record storage volume reaches 75 percent usage.

GROUP ID: V-269522
RULE ID: SV-269522r1050604

If security personnel are not notified immediately when storage volume reaches 75 percent usage, they are unable to plan for audit record storage capacity expansion.

Solution

Configure AlmaLinux OS 9 to initiate an action to notify the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity by adding/modifying the following line in the /etc/audit/auditd.conf file.

space_left_action = email

See Also

https://workbench.cisecurity.org/benchmarks/27039

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-5(1), CCI|CCI-001855, Rule-ID|SV-269522r1050604_rule, STIG-ID|ALMA-09-053590, Vuln-ID|V-269522

Plugin: Unix

Control ID: bbbb26a0611572dc52df8025ad96c7ce2f9c3e8b10886073f40dbe288a84a8d0