Detections
Analytics
ALMA-09-054360 - AlmaLinux OS 9 audit system must make full use of the audit storage space.
Information
max_log_file (size in megabytes) multiplied by num_logs must make full use of the auditd storage volume (separate to the root partition).If max_log_file_action is set to ROTATE or KEEP_LOGS then max_log_file must be set to a value that makes the most use of the storage available.
Solution
Configure AlmaLinux OS 9 to make full use of the auditd storage volume with rotation enabled.Add or update the following line in the "/etc/audit/auditd.conf" file to a value large enough to make efficient use of the auditd storage volume:
max_log_file = 100
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_CL_AlmaLinux_OS_9_V1R6_STIG.zip
Item Details
Audit Name: DISA Cloud Linux AlmaLinux OS 9 STIG v1r6
Category: AUDIT AND ACCOUNTABILITY
References: 800-53|AU-5b., CAT|II, CCI|CCI-000140, Rule-ID|SV-269528r1050411_rule, STIG-ID|ALMA-09-054360, Vuln-ID|V-269528
Plugin: Unix
Control ID: 292742ea818728405c1006c04cf9e394fa67ff7a5be2aa9041b5ccf1dfadf8a7