Allocate audit record storage capacity for at least one week

# The STIG verifies the partition holding the audit logs can store ~1 week
# of records (its guidance: typically >= 10 GB) via df on that partition —
# not a num_logs proxy, which is decoupled from partition capacity.
logfile=$(grep -iE '^[[:space:]]*log_file[[:space:]]*=' /etc/audit/auditd.conf 2>/dev/null \
            | awk -F= '{gsub(/[[:space:]]/,"",$2); print $2}' | tail -1)
logdir=$(dirname "${logfile:-/var/log/audit/audit.log}")
# -P forces POSIX single-line output (a long device name would otherwise
# wrap df onto two lines and break the field extraction).
kb=$(df -kP "$logdir" 2>/dev/null | awk 'NR==2 {print $2}')
if [ -z "$kb" ]; then
  echo "FAIL: could not determine the audit log partition capacity for $logdir"
  exit 1
fi
# 10 GB = 10485760 KB is the STIG's stated TYPICAL sufficiency, not a
# mandatory minimum — required capacity is activity-dependent. So a
# partition >= 10 GB passes; a smaller one is flagged for manual review
# rather than failed (failing it would false-FAIL a compliant low-activity
# host with a documented smaller partition).
if [ "$kb" -ge 10485760 ]; then
  echo "OK: audit log partition ($logdir) is $((kb / 1024 / 1024)) GB (>= 10 GB)"
  exit 0
fi
echo "MANUAL REVIEW REQUIRED: audit log partition ($logdir) is only $((kb / 1024)) MB, below the STIG's ~10 GB guideline. Verify it can hold one week of audit records for this system's activity level, or document the smaller size as justified."
exit 0

expected_exit:

0

path:

/etc/audit/auditd.conf

key:

num_logs

value:

5

separator:

=

restart:

auditd