mediumauditverified ✓rollback-safe
Ensure system is disabled when audit logs are full
auditd-space-left-action · RHEL ≥ 8, UBUNTU ≥ 22 · 1 impl
Description
The space_left_action setting in /etc/audit/auditd.conf must be properly configured.
Rationale
Improper space_left_action configuration could weaken system security controls.
Check → Remediate
Checkcommand
grep -qiE '^[[:space:]]*space_left_action[[:space:]]*=[[:space:]]*(email|exec)\b' /etc/audit/auditd.conf
- expected_exit:
- 0
Remediateconfig_set
- path:
- /etc/audit/auditd.conf
- key:
- space_left_action
- value:
- separator:
- =
- restart:
- auditd
Framework references
CIS
rhel9 6.3.2.3rhel10 6.3.2.3rhel8 6.3.2.3
STIG
V-258157 / RHEL-09-653040V-244543V-281113 / RHEL-10-500205V-270818 / UBTU-24-900960
NIST 800-53
AU-5
Live verification
rhel10:checkrhel8:checkrhel9:checkubuntu24:check
#audit#auditd#storage