mediumauditverified ✓rollback-safe

Configure action at 95% audit storage capacity

auditd-admin-space-left-action · RHEL ≥ 8 · 1 impl

Description

The admin_space_left_action parameter in /etc/audit/auditd.conf must be set to SINGLE or HALT to take action when the remaining audit storage volume reaches a critically low threshold (typically 5% remaining).

Rationale

When audit storage is nearly full, the system must take action to prevent loss of audit data. Halting or entering single-user mode ensures the system does not continue operating without audit capability.

Check → Remediate

Checkcommand

grep -qiE '^\s*admin_space_left_action\s*=\s*(SINGLE|HALT)' /etc/audit/auditd.conf

expected_exit:: 0

Remediateconfig_set

path:: /etc/audit/auditd.conf
key:: admin_space_left_action
value:: SINGLE
separator:: =
restart:: auditd

Framework references

STIG

V-258159 / RHEL-09-653050

NIST 800-53

AU-5(1)

Live verification

rhel9:check

#audit#auditd#storage#failure-action