Detections
Analytics
RHEL-10-500105 - RHEL 10 must take action when allocated audit record storage volume reaches 95 percent of the audit record storage capacity.
Information
If action is not taken when storage volume reaches 95 percent utilization, the auditing system may fail when the storage volume reaches capacity.Solution
Configure RHEL 10 to initiate an action when allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity by adding/modifying the following line in the /etc/audit/auditd.conf file:admin_space_left = 5%
Restart the audit daemon with the following command for the changes to take effect:
$ sudo service auditd restart
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_RHEL_10_V1R1_STIG.zip
Item Details
Audit Name: DISA Red Hat Enterprise Linux 10 STIG v1r1
Category: AUDIT AND ACCOUNTABILITY
References: 800-53|AU-5(1), CAT|II, CCI|CCI-001855, Rule-ID|SV-281107r1166273_rule, STIG-ID|RHEL-10-500105, Vuln-ID|V-281107
Plugin: Unix
Control ID: b619adb678e433648fd8a6db8656a4378f3a46497add0175fbf860aa6b07f3c7