Detections
Analytics

5.2.2.2 Ensure audit logs are not automatically deleted

Information

The expire-after specifies when audit log files will expire and be removed.

In high-security contexts, the benefits of maintaining a long audit history exceed the cost of storing the audit history.

Solution

Based on local site policy either remove the expire-after directive or set it to a larger value to retain older logs. The directive can be set in /etc/security/audit_control

expire-after:10M

The expiration specification can be one value or two values with the logical conjunction of AND/OR between them. Values for the audit log file age are numbers with the following suffixes:s Log file age in seconds.h Log file age in hours.d Log file age in days.y Log file age in years.

Values for the disk space used are numbers with the following suffixes:(space) orB Disk space used in Bytes.K Disk space used in Kilobytes.M Disk space used in Megabytes.G Disk space used in Gigabytes.

The suffixes on the values are case-sensitive. If both an age and disk space value are used they are separated by AND or OR and both values are used to determine when audit log files expire. In the case of AND, both the age and disk space conditions must be met before the log file is removed. In the case of OR, either condition may expire the log file. For example:

expire-after: 60d AND 1G

will expire files that are older than 60 days but only if 1 gigabyte of disk space total is being used by the audit logs.

See Also

https://workbench.cisecurity.org/benchmarks/19044

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-4, 800-53|AU-8, CSCv7|6.4

Plugin: Unix

Control ID: 24e044b17e48b98a46b06f51be1281c4ae22db2bea14e37650c1fef04fe55b95