STIGQter: STIG Summary: VMware vSphere 7.0 vCenter Appliance Photon OS Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 30 Jan 2025:

The Photon operating system must configure auditd to keep logging in the event max log file size is reached.

DISA Rule

SV-256528r958752_rule

Vulnerability Number

V-256528

Group Title

SRG-OS-000341-GPOS-00132

Rule Version

PHTN-30-000056

Severity

CAT II

CCI(s)

• CCI-001849 - Allocate audit log storage capacity to accommodate organization-defined audit record retention requirements.

Weight

10

Fix Recommendation

Navigate to and open:

/etc/audit/auditd.conf

Add or change the "max_log_file_action" line as follows:

max_log_file_action = IGNORE

Note: This can also be set to "ROTATE" if another tool is not used to rotate auditd logs.

At the command line, run the following commands:

# killproc auditd -TERM
# systemctl start auditd

Check Contents

At the command line, run the following command:

# grep "^max_log_file_action" /etc/audit/auditd.conf

Example result:

max_log_file_action = IGNORE

If logs are rotated outside of auditd with a tool such as logrotated, and this setting is not set to "IGNORE", this is a finding.

If logs are NOT rotated outside of auditd, and this setting is not set to "ROTATE", this is a finding.

Vulnerability Number

V-256528

Documentable

False

Rule Version

PHTN-30-000056

Severity Override Guidance

At the command line, run the following command:

# grep "^max_log_file_action" /etc/audit/auditd.conf

Example result:

max_log_file_action = IGNORE

If logs are rotated outside of auditd with a tool such as logrotated, and this setting is not set to "IGNORE", this is a finding.

If logs are NOT rotated outside of auditd, and this setting is not set to "ROTATE", this is a finding.

Check Content Reference

M

Target Key

5520