Detections
Analytics

1.282 OL08-00-030730

Information

OL 8 must take action when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.

GROUP ID: V-248818
RULE ID: SV-248818r971542

If security personnel are not notified immediately when storage volume reaches 75 percent utilization, they are unable to plan for audit record storage capacity expansion.

Solution

Configure OL 8 to initiate an action to notify the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity by adding/modifying the following line in the "/etc/audit/auditd.conf" file.

space_left = 25%

See Also

https://workbench.cisecurity.org/benchmarks/23791

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-5(1), CAT|II, CCI|CCI-001855, Rule-ID|SV-248818r971542_rule, STIG-ID|OL08-00-030730, Vuln-ID|V-248818

Plugin: Unix

Control ID: 0c37257b32f18688d12536d5bcf00881889630bcaf47fdb77324e5fcf7809d41