STIGQter: STIG Summary: MariaDB Enterprise 10.x Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Apr 2026:

MariaDB must allocate audit record storage capacity in accordance with organization-defined audit record storage requirements.

DISA Rule

SV-253727r961392_rule

Vulnerability Number

V-253727

Group Title

SRG-APP-000357-DB-000316

Rule Version

MADB-10-007300

Severity

CAT II

CCI(s)

• CCI-001849 - Allocate audit log storage capacity to accommodate organization-defined audit record retention requirements.

Weight

10

Fix Recommendation

MariaDB audit log file location either goes to the syslog directory (if logging is set to SYSLOG) or is controlled by the server_audit_file_path in the MariaDB my.cnf configuration file.

If the audit log file directory does not have enough disk space available, then increase the diskspace available for the audit log file directory or move the audit log file directory to another location that has more disk space available.
Allocate sufficient audit file space to support peak demand.

If server_audit_output_type=FILE set the directory in /etc/my.cnf to one that is managed by the centralized management system.

[mariadb]
server_audit_file_path= mydir / mylogfilename .log

Now, as the system administrator, restart the server with the new configuration:
$ systemctl restart mysqld

Allocate sufficient audit file space to support peak demand for the log files.

Check Contents

Investigate whether there have been any incidents where MariaDB ran out of audit file log disk space since the last time the space was allocated or other corrective measures were taken.

If there have been incidents where MariaDB ran out of audit log file disk space, this is a finding.

MariaDB can be configured to use syslog or any OS system file to store audit records to designated disk directories.

Check the log file location:

To check how much storage capacity is available for audit records, first determine the location where the audit logs are being written by executing the following command. Run the following SQL:

show global variables like 'server_audit%' ;

For system logs (syslog):
From the query above verify the value of:
server_audit_output_type=SYSLOG

For OS file:
From the query above verify the value of:
server_audit_output_type=FILE

If written to SYSLOG, follow the procedure for storage in the corresponding OS STIG.

If written to FILE, check the remaining storage on the disk. If it does not meet organizationally defined audit record storage requirements, this is a finding.

Vulnerability Number

V-253727

Documentable

False

Rule Version

MADB-10-007300

Severity Override Guidance

Investigate whether there have been any incidents where MariaDB ran out of audit file log disk space since the last time the space was allocated or other corrective measures were taken.

If there have been incidents where MariaDB ran out of audit log file disk space, this is a finding.

MariaDB can be configured to use syslog or any OS system file to store audit records to designated disk directories.

Check the log file location:

To check how much storage capacity is available for audit records, first determine the location where the audit logs are being written by executing the following command. Run the following SQL:

show global variables like 'server_audit%' ;

For system logs (syslog):
From the query above verify the value of:
server_audit_output_type=SYSLOG

For OS file:
From the query above verify the value of:
server_audit_output_type=FILE

If written to SYSLOG, follow the procedure for storage in the corresponding OS STIG.

If written to FILE, check the remaining storage on the disk. If it does not meet organizationally defined audit record storage requirements, this is a finding.

Check Content Reference

M

Target Key

5475