Detections
Analytics
RHEL-10-500040 - RHEL 10 must take action when allocated audit record storage volume reaches 75 percent of the audit record storage capacity.
Information
If action is not taken when storage volume reaches 75 percent utilization, the auditing system may fail when the storage volume reaches capacity.Solution
Configure RHEL 10 to initiate an action when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity by adding/modifying the following line in the /etc/audit/auditd.conf file:space_left = 25%
Restart the audit daemon with the following command for the changes to take effect:
$ sudo service auditd restart
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_RHEL_10_V1R2_STIG.zip
Item Details
Audit Name: DISA Red Hat Enterprise Linux 10 STIG v1r2
Category: AUDIT AND ACCOUNTABILITY
References: 800-53|AU-5(1), CAT|II, CCI|CCI-001855, Rule-ID|SV-281104r1208795_rule, STIG-ID|RHEL-10-500040, Vuln-ID|V-281104
Plugin: Unix
Control ID: 27c724a763d535691898726ea07d3828df35f1291f5871536b04da77adf7293c