4.1.2.3 Ensure audit system is set to single when the disk is full.

Information

The operating system must be configured so that the audit system takes appropriate action when the audit storage volume is full.

Rationale:

Taking appropriate action in case of a filled audit storage volume will minimize the possibility of losing audit records.

Solution

Configure the action the operating system takes if the disk the audit records are written to becomes full.
Uncomment or edit the disk_full_action option in /etc/audisp/audisp-remote.conf.
Example: vim /etc/audisp/audisp-remote.conf
Set it to syslog, single, or halt, such as the following example:

disk_full_action = single

See Also

https://workbench.cisecurity.org/files/3636

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-4(1), CCI|CCI-001851, CSCv7|6.2, Rule-ID|SV-204511r603261_rule, STIG-ID|RHEL-07-030320

Plugin: Unix

Control ID: 1c30059474ef1d27828c8d6e7b4b3e01115e04ee3a0eadf492aaf807764f093a