lowauditverified ✓rollback-safe
Configure auditd max_log_file
auditd-max-log-file · RHEL ≥ 8 · 1 impl
Description
The auditd max_log_file parameter should be configured to an appropriate size to store sufficient audit log data.
Rationale
Setting an appropriate maximum log file size ensures audit data is retained for forensic analysis while preventing the audit partition from filling unexpectedly.
Check → Remediate
Checkcommand
grep -E '^max_log_file\s*=' /etc/audit/auditd.conf | grep -E '[0-9]+'
- expected_exit:
- 0
Remediateconfig_set
- path:
- /etc/audit/auditd.conf
- key:
- max_log_file
- value:
- 8
- separator:
- =
- restart:
- auditd
Framework references
CIS
rhel9 6.3.2.1rhel10 6.3.2.1rhel8 6.3.2.1
NIST 800-53
AU-4
Live verification
rhel10:checkrhel8:checkrhel9:check
#audit#logging#configuration#storage