STIGQter: STIG Summary: Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide Version: 1 Release: 7 Benchmark Date: 01 Jul 2026:

AlmaLinux OS 9 audit system must take appropriate action when the audit files have reached maximum size.

DISA Rule

SV-269529r1050412_rule

Vulnerability Number

V-269529

Group Title

SRG-OS-000047-GPOS-00023

Rule Version

ALMA-09-054470

Severity

CAT II

CCI(s)

• CCI-000140 - Take organization-defined actions upon audit failure include, shutting down the system, overwriting oldest audit records, and stopping the generation of audit records.

Weight

10

Fix Recommendation

Configure AlmaLinux OS 9 to rotate the audit log when it reaches maximum size.

Add or update the following line ("max_log_file_action" can be set to "ROTATE" or "KEEP_LOGS" depending on configuration) in the "/etc/audit/auditd.conf" file:

max_log_file_action = ROTATE

Check Contents

Verify that AlmaLinux OS 9 takes the appropriate action when the audit files have reached maximum size, with the following command:

$ grep max_log_file_action /etc/audit/auditd.conf

max_log_file_action = ROTATE

If the value of the "max_log_file_action" option is not "ROTATE", "KEEP_LOGS", is commented out, or is missing, this is a finding.

Vulnerability Number

V-269529

Documentable

False

Rule Version

ALMA-09-054470

Severity Override Guidance

Verify that AlmaLinux OS 9 takes the appropriate action when the audit files have reached maximum size, with the following command:

$ grep max_log_file_action /etc/audit/auditd.conf

max_log_file_action = ROTATE

If the value of the "max_log_file_action" option is not "ROTATE", "KEEP_LOGS", is commented out, or is missing, this is a finding.

Check Content Reference

M

Target Key

5664