Detections
Analytics
PHTN-30-000057 - The Photon operating system must configure auditd to log space limit problems to syslog.
Information
If security personnel are not notified immediately when storage volume reaches 75 percent utilization, they are unable to plan for audit record storage capacity expansion.Solution
Navigate to and open:/etc/audit/auditd.conf
Ensure the 'space_left' line is uncommented and set to the following:
space_left = 75
At the command line, run the following commands:
# killproc auditd -TERM
# systemctl start auditd
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_7-0_Y25M01_STIG.zip
Item Details
Audit Name: DISA STIG VMware vSphere 7.0 Photon OS v1r4
Category: AUDIT AND ACCOUNTABILITY
References: 800-53|AU-5(1), CAT|II, CCI|CCI-001855, Rule-ID|SV-256529r971542_rule, STIG-ID|PHTN-30-000057, Vuln-ID|V-256529
Plugin: Unix
Control ID: 1cdb58fe0eeeb9ad28f7b4b7d8e353a88debb990fca49a2de9a673b5f43bb71a