8.1.1.2 Disable System on Audit Log Full - admin_space_left_action = halt

Information

The auditd daemon can be configured to halt the system when the audit logs are full. In high security contexts, the risk of detecting unauthorized access or nonrepudiation exceeds the benefit of the system's availability.

Solution

Add the following lines to the /etc/audit/auditd.conf file. space_left_action = emailaction_mail_acct = rootadmin_space_left_action = halt

See Also

https://workbench.cisecurity.org/files/85

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-5(1), 800-53|AU-5(4)

Plugin: Unix

Control ID: 2900db374605c03c0080b7bfadd39cc9314b1f519dce03959671885dea4cb0b3