Detections
Analytics

1.163 SLES-15-030800

Information

Audispd must take appropriate action when the SUSE operating system audit storage is full.

GROUP ID: V-234979
RULE ID: SV-234979r1009576

Information stored in one location is vulnerable to accidental or incidental deletion or alteration.

Off-loading is a common process in information systems with limited audit storage capacity.

Solution

Configure the SUSE operating system to take the appropriate action if the audit storage is full.

Add, edit, or uncomment the "disk_full_action" option in "/etc/audit/audisp-remote.conf". Set it to "syslog", "single" or "halt" as in the example below:

disk_full_action = syslog

See Also

https://workbench.cisecurity.org/benchmarks/23779

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-4(1), CAT|II, CCI|CCI-001851, Rule-ID|SV-234979r1009576_rule, STIG-ID|SLES-15-030800, Vuln-ID|V-234979

Plugin: Unix

Control ID: 508f30bd29aaf5386eb14184408b5689ce684e3b189d759b8f0889b28063e084