Detections
Analytics
ALMA-09-054580 - AlmaLinux OS 9 audit system must retain an optimal number of audit records.
Information
max_log_file (size in megabytes) multiplied by num_logs must make full use of the auditd storage volume (separate to the root partition).If max_log_file_action is set to ROTATE or KEEP_LOGS then num_logs must be set to a value between 2 and 99.
Solution
Configure AlmaLinux OS 9 to make full use of the auditd storage volume with rotation enabled.Add or update the following line ("num_logs" can be set to a number between 2 and 99) in the "/etc/audit/auditd.conf" file:
num_logs = 5
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_CL_AlmaLinux_OS_9_V1R5_STIG.zip
Item Details
Audit Name: DISA Cloud Linux AlmaLinux OS 9 STIG v1r5
Category: AUDIT AND ACCOUNTABILITY
References: 800-53|AU-5b., CAT|II, CCI|CCI-000140, Rule-ID|SV-269530r1050413_rule, STIG-ID|ALMA-09-054580, Vuln-ID|V-269530
Plugin: Unix
Control ID: e9d6fd218609a40765d6146205983bd6ffd044195007a5536d5fe4d3c33db3a4