STIGQter: STIG Summary: Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide Version: 2 Release: 9 Benchmark Date: 01 Jul 2026:

Ubuntu 22.04 LTS must shut down by default upon audit failure.

DISA Rule

SV-260594r1038966_rule

Vulnerability Number

V-260594

Group Title

SRG-OS-000047-GPOS-00023

Rule Version

UBTU-22-653030

Severity

CAT II

CCI(s)

• CCI-000140 - Take organization-defined actions upon audit failure include, shutting down the system, overwriting oldest audit records, and stopping the generation of audit records.

Weight

10

Fix Recommendation

Configure Ubuntu 22.04 LTS to shut down by default upon audit failure.

Add or modify the following line in the "/etc/audit/auditd.conf " file:

disk_full_action = HALT

Restart the "auditd" service for the changes to take effect:

$ sudo systemctl restart auditd.service

Note: If system availability has been determined to be more important, and this decision is documented with the ISSO, configure Ubuntu 22.04 LTS to notify system administration staff and ISSO staff in the event of an audit processing failure by setting the "disk_full_action" to "SYSLOG" or "SINGLE".

Check Contents

Verify Ubuntu 22.04 LTS takes the appropriate action when the audit storage volume is full by using the following command:

$ sudo grep -i disk_full_action /etc/audit/auditd.conf
disk_full_action = HALT

If "disk_full_action" is not set to "HALT", "SYSLOG", or "SINGLE", is commented out, or is missing, this is a finding.

Vulnerability Number

V-260594

Documentable

False

Rule Version

UBTU-22-653030

Severity Override Guidance

Verify Ubuntu 22.04 LTS takes the appropriate action when the audit storage volume is full by using the following command:

$ sudo grep -i disk_full_action /etc/audit/auditd.conf
disk_full_action = HALT

If "disk_full_action" is not set to "HALT", "SYSLOG", or "SINGLE", is commented out, or is missing, this is a finding.

Check Content Reference

M

Target Key

5594