Detections
Analytics
PHTN-30-000056 - The Photon operating system must configure auditd to keep logging in the event max log file size is reached.
Information
Audit logs are most useful when accessible by date, rather than size. This can be accomplished through a combination of an audit log rotation cron job, setting a reasonable number of logs to keep, and configuring auditd to not rotate the logs on its own. This ensures audit logs are accessible to the information system security officer (ISSO) in the event of a central log processing failure.If another solution is not used to rotate auditd logs, auditd can be configured to rotate logs.
Solution
Navigate to and open:/etc/audit/auditd.conf
Add or change the 'max_log_file_action' line as follows:
max_log_file_action = IGNORE
Note: This can also be set to 'ROTATE' if another tool is not used to rotate auditd logs.
At the command line, run the following commands:
# killproc auditd -TERM
# systemctl start auditd
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_7-0_Y25M01_STIG.zip
Item Details
Audit Name: DISA STIG VMware vSphere 7.0 Photon OS v1r4
Category: AUDIT AND ACCOUNTABILITY
References: 800-53|AU-4, CAT|II, CCI|CCI-001849, Rule-ID|SV-256528r958752_rule, STIG-ID|PHTN-30-000056, Vuln-ID|V-256528
Plugin: Unix
Control ID: e16d761b844c1fe44ca27f7ba357602ef101ffab82f54e9a07a597aafb8421ff