OL6-00-000311 - The audit system must provide a warning when allocated audit record storage volume reaches a documented percentage of maximum audit record storage capacity.

Information

Notifying administrators of an impending disk space problem may allow them to take corrective action prior to any disruption.

Solution

The 'auditd' service can be configured to take an action when disk space starts to run low. Edit the file '/etc/audit/auditd.conf'. Modify the following line, substituting [num_megabytes] appropriately:

space_left = [num_megabytes]

The 'num_megabytes' value should be set to a fraction of the total audit storage capacity available that will allow a system administrator to be notified with enough time to respond to the situation causing the capacity issues. This value must also be documented locally.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_Linux_6_V2R6_STIG.zip

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-5(1), CAT|II, CCI|CCI-001855, Rule-ID|SV-219577r793834_rule, STIG-ID|OL6-00-000311, STIG-Legacy|SV-65257, STIG-Legacy|V-51051, Vuln-ID|V-219577

Plugin: Unix

Control ID: 21fc249b8e679077a9dd6288bac5db371f2a96c0d2e64607687c5fcb1011b0f4