Detections
Analytics

O19C-00-005700 - Oracle Database must allocate audit record storage capacity in accordance with organization-defined audit record storage requirements.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

To ensure sufficient storage capacity for the audit logs, Oracle Database must be able to allocate audit record storage capacity. Although another requirement (SRG-APP-000515-DB-000318) mandates audit data be off-loaded to a centralized log management system, it remains necessary to provide space on the database server to serve as a buffer against outages and capacity limits of the off-loading mechanism.

The task of allocating audit record storage capacity is usually performed during initial installation of the database management system (DBMS) and is closely associated with the database administrator (DBA) and system administrator roles. The DBA or system administrator will usually coordinate the allocation of physical drive space with the application owner/installer and the application will prompt the installer to provide the capacity information, the physical location of the disk, or both.

In determining the capacity requirements, consider such factors as: total number of users; expected number of concurrent users during busy periods; number and type of events being monitored; types and amounts of data being captured; the frequency/speed with which audit records are off-loaded to the central log management system; and any limitations that exist on the DBMS's ability to reuse the space formerly occupied by off-loaded records.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Allocate sufficient audit file/table space to support peak demand.

If audit records are being written to the table sys.aud$, create a new tablespace dedicated to the AUD$ table and move AUD$ using the statement below:

exec sys.dbms_audit_mgmt.move_dbaudit_tables('<tablespace_name>');

Ensure that audit tables are in their own tablespaces and that the tablespaces have enough room for the volume of log data that will be produced.

Detailed procedures for how to alter the tablespace for audit logs can be found here:
https://docs.oracle.com/en/database/oracle/oracle-database/19/sqlrf/ALTER-TABLESPACE.html.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_Database_19c_V1R4_STIG.zip

Item Details

References: CAT|II, CCI|CCI-001849, Rule-ID|SV-270506r1167744_rule, STIG-ID|O19C-00-005700, Vuln-ID|V-270506

Plugin: OracleDB

Control ID: 1c18b3e09cc079a57d5e438d89a963582153ed4d8c8e9ae796d553b0a666a1d4