Detections
Analytics

4.1.2.3 Ensure system is disabled when audit logs are full - space_left_action

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The auditd daemon can be configured to halt the system when the audit logs are full.

Rationale:

In high security contexts, the risk of detecting unauthorized access or nonrepudiation exceeds the benefit of the system's availability.

Solution

Set the following parameters in /etc/audit/auditd.conf:

space_left_action = email
action_mail_acct = root
admin_space_left_action = halt

See Also

https://workbench.cisecurity.org/files/2854

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-5(2), CSCv7|6.2

Plugin: Unix

Control ID: 4417c4ce2ed0f2b2cd6e0b94f577e215eb096b7f2eb9d61c39bb7a2ad04d2195