Detections
Analytics

1.374 RHEL-09-653045

Information

RHEL 9 must take action when allocated audit record storage volume reaches 95 percent of the audit record storage capacity.

GROUP ID: V-258158
RULE ID: SV-258158r971542

If action is not taken when storage volume reaches 95 percent utilization, the auditing system may fail when the storage volume reaches capacity.

Solution

Configure RHEL 9 to initiate an action when allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity by adding/modifying the following line in the /etc/audit/auditd.conf file.

admin_space_left = 5%

See Also

https://workbench.cisecurity.org/benchmarks/22008

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-5(1), CAT|II, CCI|CCI-001855, Rule-ID|SV-258158r971542_rule, STIG-ID|RHEL-09-653045, Vuln-ID|V-258158

Plugin: Unix

Control ID: 7793ebbd41dd59e618396fc3aebf00f74309dcf80d3a08e8f485e93c464cd2da