Detections
Analytics

1.30 SOL-11.1-010410

Information

The operating system must configure auditing to reduce the likelihood of storage capacity being exceeded.

GROUP ID: V-219996RULE ID: SV-219996r958752

Overflowing the audit storage area can result in a denial of service or system outage.

Solution

The Audit Control profile is required.

This action applies to the global zone only. Determine the zone that you are currently securing.

zonename

If the command output is "global", this action applies.

Set the size of a binary audit file to a specific size. The size is specified in megabytes.

pfexec auditconfig -setplugin audit_binfile p_fsize=4M

Restart the audit system.

pfexec audit -s

See Also

https://workbench.cisecurity.org/benchmarks/23873

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-4, CAT|I, CCI|CCI-001849, Rule-ID|SV-219996r958752_rule, STIG-ID|SOL-11.1-010410, Vuln-ID|V-219996

Plugin: Unix

Control ID: 9331c1dbf7da54ac92fd51c959b8d1009391d5f293ddcc92b4186ef5c438231c