Detections
Analytics
RHEL-09-653065 - RHEL 9 must take appropriate action when the internal event queue is full.
Information
The audit system should have an action setup in the event the internal event queue becomes full so that no data is lost. Information stored in one location is vulnerable to accidental or incidental deletion or alteration.Offloading is a common process in information systems with limited audit storage capacity.
Satisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224
Solution
Edit the /etc/audit/auditd.conf file and add or update the "overflow_action" option:overflow_action = syslog
The audit daemon must be restarted for changes to take effect.
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_RHEL_9_V2R9_STIG.zip
Item Details
Audit Name: DISA Red Hat Enterprise Linux 9 STIG v2r9
Category: AUDIT AND ACCOUNTABILITY
References: 800-53|AU-4(1), CAT|II, CCI|CCI-001851, Rule-ID|SV-258162r1184331_rule, STIG-ID|RHEL-09-653065, Vuln-ID|V-258162
Plugin: Unix
Control ID: 64950e6767f50885de34b5804d872ab737b217af4d02b4ed045cec98e645f161