OL6-00-000511 - The audit system must take appropriate action when there are disk errors on the audit storage volume.

Information

Taking appropriate action in case of disk errors will minimize the possibility of losing audit records.

Solution

Edit the file '/etc/audit/auditd.conf'. Modify the following line, substituting [ACTION] appropriately:

disk_error_action = [ACTION]

Possible values for [ACTION] are described in the 'auditd.conf' man page. These include:

'ignore'
'syslog'
'exec'
'suspend'
'single'
'halt'

Set this to 'syslog', 'exec', 'single', or 'halt'.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_Linux_6_V2R7_STIG.zip

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-5b., CAT|II, CCI|CCI-000140, Rule-ID|SV-209059r793780_rule, STIG-ID|OL6-00-000511, STIG-Legacy|SV-64805, STIG-Legacy|V-50599, Vuln-ID|V-209059

Plugin: Unix

Control ID: 17a8c8481edd5949dbc338ff72d992219e1c9858c58c2117df56fb7aa59b87ff