Detections
Analytics
SQL2-00-010500 - SQL Server auditing configuration maximum number of files must be configured to reduce the likelihood of storage capacity being exceeded, while meeting organization-defined auditing requirements - 'max_files'
Information
Configure SQL Server during the installation and/or configuration process to determine if adequate storage capacity has been allocated for audit logs.If SQL Server audit logs that are being generated exceed the amount of space reserved for those logs, the system may shutdown or take other measures to stop processing in order to protect transactions from continuing unlogged.
After the initial setup of SQL Server audit log configuration, it is best to check the available space frequently until the maximum number of files has been reached. Checking the available space can help determine the balance of online audit data with space required.
Solution
Configure the maximum number of audit log files that are to be generated, staying within the number of logs the system was sized to support.Update the max_files parameter of the audits to ensure the correct number of files is defined.
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_SQL_Server_2012_V1R20_STIG.zip
Item Details
Category: AUDIT AND ACCOUNTABILITY
References: 800-53|AU-4, CAT|II, CCI|CCI-001849, Rule-ID|SV-53399r2_rule, STIG-ID|SQL2-00-010500, Vuln-ID|V-41024
Plugin: MS_SQLDB
Control ID: 72c433e9e2e4fa65cd70334f52a30ae0ad63b5414f6e336b169206dd14fbf271