mediumauditverified ✓rollback-safe
Configure auditd admin_space_left_action
auditd-admin-space-action · RHEL ≥ 8 · 1 impl
Description
The auditd daemon must halt the system when the audit storage volume is critically low on space.
Rationale
When audit storage is exhausted, the system must halt to prevent security events from going unrecorded. This ensures continuous audit logging for forensic purposes.
Check → Remediate
Checkconfig_value
- path:
- /etc/audit/auditd.conf
- key:
- admin_space_left_action
- expected:
- single
Remediateconfig_set
- path:
- /etc/audit/auditd.conf
- key:
- admin_space_left_action
- value:
- single
- separator:
- =
- reload:
- auditd
Framework references
STIG
V-230389V-281108 / RHEL-10-500110
NIST 800-53
AU-5
Live verification
rhel10:checkrhel8:check
#audit#auditd#storage#stig