MADB-10-007300 - MariaDB must allocate audit record storage capacity in accordance with organization-defined audit record storage requirements.

Information

To ensure sufficient storage capacity for the audit logs, MariaDB must be able to allocate audit record storage capacity. Although another requirement (SRG-APP-000515-DB-000318) mandates that audit data be off-loaded to a centralized log management system, it remains necessary to provide space on the database server to serve as a buffer against outages and capacity limits of the off-loading mechanism.

The task of allocating audit record storage capacity is usually performed during initial installation of MariaDB and is closely associated with the DBA and system administrator roles. The DBA or system administrator will usually coordinate the allocation of physical drive space with the application owner/installer and the application will prompt the installer to provide the capacity information, the physical location of the disk, or both.

In determining the capacity requirements, consider such factors as total number of users; expected number of concurrent users during busy periods; number and type of events being monitored; types and amounts of data being captured; the frequency/speed with which audit records are off-loaded to the central log management system; and any limitations that exist on MariaDB s ability to reuse the space formerly occupied by off-loaded records.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

MariaDB audit log file location either goes to the syslog directory (if logging is set to SYSLOG) or is controlled by the server_audit_file_path in the MariaDB my.cnf configuration file.

If the audit log file directory does not have enough disk space available, then increase the diskspace available for the audit log file directory or move the audit log file directory to another location that has more disk space available.
Allocate sufficient audit file space to support peak demand.

If server_audit_output_type=FILE set the directory in /etc/my.cnf to one that is managed by the centralized management system.

[mariadb]
server_audit_file_path= mydir / mylogfilename .log

Now, as the system administrator, restart the server with the new configuration:
$ systemctl restart mysqld

Allocate sufficient audit file space to support peak demand for the log files.

Item Details

Audit Name: DISA MariaDB Enterprise 10.x v2r1 DB

Category: AUDIT AND ACCOUNTABILITY

Plugin: MySQLDB

Control ID: c437f6d77a1b0e67ba75499b2c46926684f1e9682dcb06c53198c2a80f6d606a

Detections

Analytics

MADB-10-007300 - MariaDB must allocate audit record storage capacity in accordance with organization-defined audit record storage requirements.

Information

Solution

See Also

Item Details