Detections
Analytics
AZLX-23-002030 - Amazon Linux 2023 must take appropriate action when the internal event queue is full.
Information
The audit system should have an action setup in the event the internal event queue becomes full so that no data is lost. Information stored in one location is vulnerable to accidental or incidental deletion or alteration.Solution
Configure Amazon Linux 2023 so that the audit system takes an appropriate action when the internal event queue is full.Edit the /etc/audit/auditd.conf file and add or update the "overflow_action" option:
overflow_action = syslog
The audit daemon must be restarted for changes to take effect.
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Amazon_Linux_2023_V1R2_STIG.zip
Item Details
Audit Name: DISA Amazon Linux 2023 STIG v1r2
Category: AUDIT AND ACCOUNTABILITY
References: 800-53|AU-4(1), CAT|II, CCI|CCI-001851, Rule-ID|SV-274070r1120198_rule, STIG-ID|AZLX-23-002030, Vuln-ID|V-274070
Plugin: Unix
Control ID: 8755dcae47c96f6ddb9604b9c604f969dc49b9a786dbacf140c9dec922a07553