STIGQter: STIG Summary: VMware vSphere 7.0 vCenter Appliance Photon OS Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 30 Jan 2025:

The Photon operating system audit log must attempt to log audit failures to syslog.

DISA Rule

SV-256492r1038966_rule

Vulnerability Number

V-256492

Group Title

SRG-OS-000047-GPOS-00023

Rule Version

PHTN-30-000015

Severity

CAT II

CCI(s)

• CCI-000140 - Take organization-defined actions upon audit failure include, shutting down the system, overwriting oldest audit records, and stopping the generation of audit records.

Weight

10

Fix Recommendation

Navigate to and open:

/etc/audit/auditd.conf

Ensure the following lines are present, not duplicated, and not commented:

disk_full_action = SYSLOG
disk_error_action = SYSLOG
admin_space_left_action = SYSLOG

At the command line, run the following commands:

# killproc auditd -TERM
# systemctl start auditd

Check Contents

At the command line, run the following command:

# grep -E "^disk_full_action|^disk_error_action|^admin_space_left_action" /etc/audit/auditd.conf

If any of the above parameters are not set to "SYSLOG" or are missing, this is a finding.

Vulnerability Number

V-256492

Documentable

False

Rule Version

PHTN-30-000015

Severity Override Guidance

At the command line, run the following command:

# grep -E "^disk_full_action|^disk_error_action|^admin_space_left_action" /etc/audit/auditd.conf

If any of the above parameters are not set to "SYSLOG" or are missing, this is a finding.

Check Content Reference

M

Target Key

5520