Detections
Analytics

1.30 SOL-11.1-010410

Information

The operating system must configure auditing to reduce the likelihood of storage capacity being exceeded.

GROUP ID: V-219968
RULE ID: SV-219968r958752

Overflowing the audit storage area can result in a denial of service or system outage.

Solution

The Audit Control profile is required.

This action applies to the global zone only. Determine the zone that you are currently securing.

# zonename

If the command output is "global", this action applies.

Set the size of a binary audit file to a specific size. The size is specified in megabytes.

# pfexec auditconfig -setplugin audit_binfile p_fsize=4M

Restart the audit system.

# pfexec audit -s

See Also

https://workbench.cisecurity.org/benchmarks/23765

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-4, CAT|I, CCI|CCI-001849, Rule-ID|SV-219968r958752_rule, STIG-ID|SOL-11.1-010410, Vuln-ID|V-219968

Plugin: Unix

Control ID: d014f8a34c9e5b2d1dfa7f26c8024eda636c14230d07a1446e3877a6c833ddec