STIGQter: STIG Summary: VMware vSphere 8.0 vCenter Appliance Photon OS 4.0 Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 01 Jul 2026:

The Photon operating system must alert the ISSO and SA in the event of an audit processing failure.

DISA Rule

SV-258810r958424_rule

Vulnerability Number

V-258810

Group Title

SRG-OS-000046-GPOS-00022

Rule Version

PHTN-40-000021

Severity

CAT II

CCI(s)

• CCI-000139 - Alert organization-defined personnel or roles within an organization-defined time period in the event of an audit logging process failure.
• CCI-001858 - Provide an alert in an organization-defined real-time-period to organization-defined personnel, roles, and/or locations when organization-defined audit failure events requiring real-time alerts occur.

Weight

10

Fix Recommendation

Navigate to and open:

/etc/audit/auditd.conf

Ensure the following lines are present, not duplicated, and not commented:

disk_full_action = SYSLOG
disk_error_action = SYSLOG
admin_space_left_action = SYSLOG

At the command line, run the following command:

# pkill -SIGHUP auditd

Check Contents

At the command line, run the following command to verify auditd is configured to send an alert via syslog in the event of an audit processing failure:

# grep -E "^disk_full_action|^disk_error_action|^admin_space_left_action" /etc/audit/auditd.conf

Example result:

admin_space_left_action = SYSLOG
disk_full_action = SYSLOG
disk_error_action = SYSLOG

If "disk_full_action", "disk_error_action", and "admin_space_left_action" are not set to SYSLOG or are missing, this is a finding.

Vulnerability Number

V-258810

Documentable

False

Rule Version

PHTN-40-000021

Severity Override Guidance

At the command line, run the following command to verify auditd is configured to send an alert via syslog in the event of an audit processing failure:

# grep -E "^disk_full_action|^disk_error_action|^admin_space_left_action" /etc/audit/auditd.conf

Example result:

admin_space_left_action = SYSLOG
disk_full_action = SYSLOG
disk_error_action = SYSLOG

If "disk_full_action", "disk_error_action", and "admin_space_left_action" are not set to SYSLOG or are missing, this is a finding.

Check Content Reference

M

Target Key

5569