Detections
Analytics

1.3 RHEL-10-000520

Information

RHEL 10 must use a separate file system for the system audit data path.

GROUP ID: V-280936RULE ID: SV-280936r1184726

Placing "/var/log/audit" in its own partition enables better separation between audit files and other system files and helps ensure that auditing cannot be halted due to the partition running out of space.

Solution

Configure RHEL 10 to use a separate file system for the system audit data path by migrating "/var/log/audit" onto a separate file system.

See Also

https://workbench.cisecurity.org/benchmarks/26403

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-4, CAT|III, CCI|CCI-001849, Rule-ID|SV-280936r1184726_rule, STIG-ID|RHEL-10-000520, Vuln-ID|V-280936

Plugin: Unix

Control ID: f6545ba02e864737ba4acdfba4421f8e452c8a66a51161cc32f7ba0063f9453c