4.1.2.1 Ensure audit log storage size is configured

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

Information

Configure the maximum size of the audit log file. Once the log reaches the maximum size, it will be rotated and a new log file will be started.

Notes:

The max_log_file parameter is measured in megabytes.

Other methods of log rotation may be appropriate based on site policy. One example is time-based rotation strategies which don't have native support in auditd configurations. Manual audit of custom configurations should be evaluated for effectiveness and completeness.

Rationale:

It is important that an appropriate size is determined for log files so that they do not impact the system and audit data is not lost.