STIGQter: STIG Summary: Oracle Linux 8 Security Technical Implementation Guide Version: 2 Release: 9 Benchmark Date: 01 Jul 2026:

The OL 8 audit system must take appropriate action when the audit storage volume is full.

DISA Rule

SV-248728r1038966_rule

Vulnerability Number

V-248728

Group Title

SRG-OS-000047-GPOS-00023

Rule Version

OL08-00-030060

Severity

CAT II

CCI(s)

• CCI-000140 - Take organization-defined actions upon audit failure include, shutting down the system, overwriting oldest audit records, and stopping the generation of audit records.

Weight

10

Fix Recommendation

Configure OL 8 to shut down by default upon audit failure (unless availability is an overriding concern).

Add or update the following line ("disk_full_action" can be set to "SYSLOG" or "SINGLE" depending on configuration) in the "/etc/audit/auditd.conf" file:

disk_full_action = HALT

If availability has been determined to be more important, and this decision is documented with the ISSO, configure OL 8 to notify system administration staff and ISSO staff in the event of an audit processing failure by setting the "disk_full_action" to "SYSLOG".

Check Contents

Verify OL 8 takes the appropriate action when the audit storage volume is full with the following command:

$ sudo grep disk_full_action /etc/audit/auditd.conf

disk_full_action = HALT

If the value of the "disk_full_action" option is not "SYSLOG", "SINGLE", or "HALT", or the line is commented out, this is a finding.

Vulnerability Number

V-248728

Documentable

False

Rule Version

OL08-00-030060

Severity Override Guidance

Verify OL 8 takes the appropriate action when the audit storage volume is full with the following command:

$ sudo grep disk_full_action /etc/audit/auditd.conf

disk_full_action = HALT

If the value of the "disk_full_action" option is not "SYSLOG", "SINGLE", or "HALT", or the line is commented out, this is a finding.

Check Content Reference

M

Target Key

5416