mediumauditverified ✓rollback-safe

Configure action on critical audit processing failure

auditd-disk-error-action · RHEL ≥ 8 · 1 impl

Description

The disk_error_action parameter in /etc/audit/auditd.conf must be set to SYSLOG, SINGLE, or HALT to take appropriate action when a critical audit processing failure occurs.

Rationale

When a disk error occurs during audit logging, the system must take appropriate action to preserve the integrity of the audit trail. Silently ignoring disk errors could allow audit data to be lost.

Check → Remediate

Checkcommand

grep -qiE '^\s*disk_error_action\s*=\s*(SYSLOG|SINGLE|HALT)' /etc/audit/auditd.conf

expected_exit:: 0

Remediateconfig_set

path:: /etc/audit/auditd.conf
key:: disk_error_action
value:: SYSLOG
separator:: =
restart:: auditd

Framework references

STIG

V-258153 / RHEL-09-653020V-230390 / RHEL-08-030040

NIST 800-53

AU-5

Live verification

rhel9:check

#audit#auditd#disk-error#failure-action