STIGQter: STIG Summary: Amazon Linux 2023 Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Jul 2026:

Amazon Linux 2023 must off-load audit records onto a different system in the event the audit storage volume is full.

DISA Rule

SV-274107r1120309_rule

Vulnerability Number

V-274107

Group Title

SRG-OS-000342-GPOS-00133

Rule Version

AZLX-23-002220

Severity

CAT II

CCI(s)

CCI-001851 - Transfer audit logs per organization-defined frequency to a different system, system component, or media than the system or system component conducting the logging.

Weight

Fix Recommendation

Configure Amazon Linux 2023 to off-load audit logs in the event the audit storage volume becomes full.

Add or update the following line (depending on configuration "disk_full_action" can be set to "SYSLOG" or "SINGLE" depending on configuration) in "/etc/audit/auditd.conf" file:

disk_full_action = SYSLOG

Check Contents

Verify Amazon Linux 2023 takes the appropriate action when the audit storage volume is full using the following command:

$ sudo grep disk_full_action /etc/audit/auditd.conf
disk_full_action = SYSLOG

If the value of the "disk_full_action" option is not "SYSLOG", "SINGLE", or "HALT", or the line is commented out, ask the system administrator to indicate how the system takes appropriate action when an audit storage volume is full. If there is no evidence of appropriate action, this is a finding.

Vulnerability Number

V-274107

Documentable

False

Rule Version

AZLX-23-002220

Severity Override Guidance

Check Content Reference

Target Key

5700