STIGQter STIGQter: STIG Summary: Oracle Linux 6 Security Technical Implementation Guide Version: 1 Release: 17 Benchmark Date: 25 Oct 2019: The audit system must provide a warning when allocated audit record storage volume reaches a documented percentage of maximum audit record storage capacity.

DISA Rule

SV-65257r2_rule

Vulnerability Number

V-51051

Group Title

SRG-OS-000048

Rule Version

OL6-00-000311

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

The "auditd" service can be configured to take an action when disk space starts to run low. Edit the file "/etc/audit/auditd.conf". Modify the following line, substituting [num_megabytes] appropriately:

space_left = [num_megabytes]

The "num_megabytes" value should be set to a fraction of the total audit storage capacity available that will allow a system administrator to be notified with enough time to respond to the situation causing the capacity issues. This value must also be documented locally.

Check Contents

Inspect "/etc/audit/auditd.conf" and locate the following line to determine whether the system is configured to email the administrator when disk space is starting to run low:

# grep space_left /etc/audit/auditd.conf

space_left = [num_megabytes]

If the "num_megabytes" value does not correspond to a documented value for remaining audit partition capacity or if there is no locally documented value for remaining audit partition capacity, this is a finding.

Vulnerability Number

V-51051

Documentable

False

Rule Version

OL6-00-000311

Severity Override Guidance

Inspect "/etc/audit/auditd.conf" and locate the following line to determine whether the system is configured to email the administrator when disk space is starting to run low:

# grep space_left /etc/audit/auditd.conf

space_left = [num_megabytes]

If the "num_megabytes" value does not correspond to a documented value for remaining audit partition capacity or if there is no locally documented value for remaining audit partition capacity, this is a finding.

Check Content Reference

M

Target Key

2208

Comments