Detections
Analytics

1.178 RHEL-10-500110

Information

RHEL 10 must take action when allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity.

GROUP ID: V-281108RULE ID: SV-281108r1166276

If action is not taken when storage volume reaches 95 percent utilization, the auditing system may fail when the storage volume reaches capacity.

Solution

Configure RHEL 10 auditd service to take action if allocated audit record storage volume reaching 95 percent of the repository maximum audit record storage capacity.

Edit the following line in "/etc/audit/auditd.conf" to ensure the system is forced into single user mode if the audit record storage volume is about to reach maximum capacity:

admin_space_left_action = single

Restart the audit daemon with the following command for the changes to take effect:

$ sudo service auditd restart

See Also

https://workbench.cisecurity.org/benchmarks/26403

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-5(1), CAT|II, CCI|CCI-001855, Rule-ID|SV-281108r1166276_rule, STIG-ID|RHEL-10-500110, Vuln-ID|V-281108

Plugin: Unix

Control ID: b317053a1e2e0a3a8122b8814c48c1ac96327d909f564c878ea0d489b97afb3b