PHTN-30-000057 - The Photon operating system must configure auditd to log space limit problems to syslog.

Information

If security personnel are not notified immediately when storage volume reaches 75 percent utilization, they are unable to plan for audit record storage capacity expansion.

Solution

Navigate to and open:

/etc/audit/auditd.conf

Ensure the 'space_left' line is uncommented and set to the following:

space_left = 75

At the command line, run the following commands:

# killproc auditd -TERM
# systemctl start auditd

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_7-0_Y24M01_STIG.zip

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-5(1), CAT|II, CCI|CCI-001855, Rule-ID|SV-256529r887261_rule, STIG-ID|PHTN-30-000057, Vuln-ID|V-256529

Plugin: Unix

Control ID: 96a3d2d38ee07e45727db17fa04f259dddec77cc5c712558aa55fca7dfb5cafd