STIGQter: STIG Summary: VMware vSphere 8.0 vCenter Appliance Photon OS 4.0 Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 31 Oct 2023:

The Photon operating system must immediately notify the SA and ISSO when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.

DISA Rule

SV-258845r935564_rule

Vulnerability Number

V-258845

Group Title

SRG-OS-000343-GPOS-00134

Rule Version

PHTN-40-000112

Severity

CAT III

CCI(s)

• CCI-001855 - Provide a warning to organization-defined personnel, roles, and/or locations within an organization-defined time period when allocated audit log storage volume reaches an organization-defined percentage of repository maximum audit log storage capacity.

Weight

10

Fix Recommendation

Navigate to and open:

/etc/audit/auditd.conf

Ensure the "space_left" and "space_left_action" lines are uncommented and set to the following:

space_left = 25%
space_left_action = SYSLOG

At the command line, run the following command:

# pkill -SIGHUP auditd

Check Contents

At the command line, run the following command to verify auditd is alerting when low disk space is detected:

# grep '^space_left' /etc/audit/auditd.conf

Expected result:

space_left = 25%
space_left_action = SYSLOG

If the output does not match the expected result, this is a finding.

Vulnerability Number

V-258845

Documentable

False

Rule Version

PHTN-40-000112

Severity Override Guidance

At the command line, run the following command to verify auditd is alerting when low disk space is detected:

# grep '^space_left' /etc/audit/auditd.conf

Expected result:

space_left = 25%
space_left_action = SYSLOG

If the output does not match the expected result, this is a finding.

Check Content Reference

M

Target Key

5569