mediumauditverified ✓rollback-safe
Configure auditd space_left threshold to 25 percent
auditd-space-left-percent · RHEL ≥ 8 · 1 impl
Description
The auditd space_left parameter must be configured to notify the system administrator when the audit log storage volume has 25 percent or less capacity remaining.
Rationale
Configuring a space_left threshold ensures administrators are alerted before audit storage is exhausted. A 25 percent threshold provides adequate warning time to take corrective action.
Check → Remediate
Checkconfig_value
- path:
- /etc/audit/auditd.conf
- key:
- space_left
- expected:
- 25%
Remediateconfig_set
- path:
- /etc/audit/auditd.conf
- key:
- space_left
- value:
- 25%
- separator:
- =
- reload:
- auditd
Framework references
STIG
V-258156 / RHEL-09-653035V-230483V-281104 / RHEL-10-500040
NIST 800-53
AU-5
Live verification
rhel10:checkrhel8:checkrhel9:check
#audit#auditd#storage#stig