OL6-00-000005 - The audit system must alert designated staff members when the audit storage volume approaches capacity.

Information

Notifying administrators of an impending disk space problem may allow them to take corrective action prior to any disruption.

Solution

The 'auditd' service can be configured to take an action when disk space starts to run low. Edit the file '/etc/audit/auditd.conf'. Modify the following line, substituting [ACTION] appropriately:

space_left_action = [ACTION]

Possible values for [ACTION] are described in the 'auditd.conf' man page. These include: 'ignore',
'syslog', 'email', 'exec', 'suspend', 'single', and 'halt'. Set this to 'email' (instead of the default, which is 'suspend') as it is more likely to get prompt attention. The 'syslog' option is acceptable, provided the local log management infrastructure notifies an appropriate administrator in a timely manner.

OL6-00-000521 ensures that the email generated through the operation 'space_left_action' will be sent to an administrator.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_Linux_6_V2R7_STIG.zip

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-5(1), CAT|II, CCI|CCI-001855, Rule-ID|SV-219542r854337_rule, STIG-ID|OL6-00-000005, STIG-Legacy|SV-64877, STIG-Legacy|V-50671, Vuln-ID|V-219542

Plugin: Unix

Control ID: dd79fc517df530ce84db5d260353b348aa0f1ff3416ee75d4883f53065fca3f7