mediumauditverified ✓rollback-safe
Configure auditd disk_full_action
auditd-disk-full-action · RHEL ≥ 8 · 1 impl
Description
The auditd daemon must halt the system when the audit storage disk is full to prevent loss of audit data.
Rationale
When audit storage is completely full, the system must halt to prevent security events from going unrecorded. This ensures audit continuity for compliance and forensics.
Check → Remediate
Checkconfig_value
- path:
- /etc/audit/auditd.conf
- key:
- disk_full_action
- expected:
- halt
Remediateconfig_set
- path:
- /etc/audit/auditd.conf
- key:
- disk_full_action
- value:
- halt
- separator:
- =
- reload:
- auditd
Framework references
STIG
V-258154 / RHEL-09-653025V-230392
NIST 800-53
AU-5
Live verification
rhel8:checkrhel9:check
#audit#auditd#storage#stig