Detections
Analytics

1.166 OL09-00-000875

Information

OL 9 must take action when allocated audit record storage volume reaches 95 percent of the audit record storage capacity.

GROUP ID: V-271601
RULE ID: SV-271601r1091515

If action is not taken when storage volume reaches 95 percent utilization, the auditing system may fail when the storage volume reaches capacity.

Solution

Configure OL 9 to initiate an action when allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity by adding/modifying the following line in the /etc/audit/auditd.conf file.

admin_space_left = 5%

See Also

https://workbench.cisecurity.org/benchmarks/27024

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-5(1), CCI|CCI-001855, Rule-ID|SV-271601r1091515_rule, STIG-ID|OL09-00-000875, Vuln-ID|V-271601

Plugin: Unix

Control ID: 67902b249c0589343fccb9755b25d60edb5f3342f83d626acfc343236b7ff7a2