SV-268251r1038695_rule
V-268251
SRG-APP-000357-NDM-000293
HYCU-ND-000390
CAT II
10
Configure the operating system to enforce log rotation and restrict log file size to an organization-defined value by editing "/etc/audit/auditd.conf" files using the following command:
sudo vi /etc/audit/auditd.conf
Add or modify the following lines to have the required value for the organization. Refer to the sample below:
max_log_file_action = ROTATION
max_log_file = 6
Log in to the HYCU VM console.
Review the /etc/audit/auditd.conf file and verify that the settings are in accordance with organizational policies.
If it is not configured in accordance with organizational policies, this is a finding.
Check for the value of the "max_log_file_action" option in "/etc/audit/auditd.conf" with the following command:
sudo grep max_log_file_action /etc/audit/auditd.conf
If the "max_log_file_action" value is not set to "ROTATION", this is a finding.
V-268251
False
HYCU-ND-000390
Log in to the HYCU VM console.
Review the /etc/audit/auditd.conf file and verify that the settings are in accordance with organizational policies.
If it is not configured in accordance with organizational policies, this is a finding.
Check for the value of the "max_log_file_action" option in "/etc/audit/auditd.conf" with the following command:
sudo grep max_log_file_action /etc/audit/auditd.conf
If the "max_log_file_action" value is not set to "ROTATION", this is a finding.
M
5660