STIGQter: STIG Summary: SUSE Linux Enterprise Micro (SLEM) 5 Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Apr 2026:

SLEM 5 audit system must take appropriate action when the audit storage volume is full.

DISA Rule

SV-261415r1038966_rule

Vulnerability Number

V-261415

Group Title

SRG-OS-000047-GPOS-00023

Rule Version

SLEM-05-653035

Severity

CAT II

CCI(s)

• CCI-000140 - Take organization-defined actions upon audit failure include, shutting down the system, overwriting oldest audit records, and stopping the generation of audit records.

Weight

10

Fix Recommendation

Configure SLEM 5 to shut down by default upon audit failure.

Add or modify the following line in the "/etc/audit/auditd.conf " file:

disk_full_action = HALT

Note: If system availability has been determined to be more important, and this decision is documented with the information system security officer (ISSO), configure SLEM 5 to notify system administration staff and ISSO staff in the event of an audit processing failure by setting the "disk_full_action" to "SYSLOG" or "SINGLE".

Check Contents

Verify SLEM 5 takes the appropriate action when the audit storage volume is full using the following command:

> sudo grep disk_full_action /etc/audit/auditd.conf
disk_full_action = HALT

If "disk_full_action" is not set to "HALT", "SYSLOG", or "SINGLE", is commented out, or is missing, this is a finding.

Vulnerability Number

V-261415

Documentable

False

Rule Version

SLEM-05-653035

Severity Override Guidance

Verify SLEM 5 takes the appropriate action when the audit storage volume is full using the following command:

> sudo grep disk_full_action /etc/audit/auditd.conf
disk_full_action = HALT

If "disk_full_action" is not set to "HALT", "SYSLOG", or "SINGLE", is commented out, or is missing, this is a finding.

Check Content Reference

M

Target Key

5596