mediumauditverified ✓rollback-safe
Ensure system warns when audit logs are low on space
auditd-space-low-warning · RHEL ≥ 8 · 1 impl
Description
The audit system should be configured to warn administrators when disk space for audit logs is running low.
Rationale
If audit logs fill the disk, new events cannot be recorded. Warning before space runs out allows administrators to take corrective action.
Check → Remediate
Checkcommand
# Check space_left_action in auditd.conf
action=$(grep -E '^space_left_action\s*=' /etc/audit/auditd.conf 2>/dev/null | awk -F= '{print $2}' | tr -d ' ')
case "$action" in
email|exec|single|halt|syslog)
echo "OK: space_left_action is set to $action"
exit 0
;;
*)
echo "FAIL: space_left_action not properly configured (current: $action)"
exit 1
;;
esac
- expected_exit:
- 0
Remediateconfig_set
- path:
- /etc/audit/auditd.conf
- key:
- space_left_action
- value:
- separator:
- =
- restart:
- auditd
Framework references
CIS
rhel9 6.3.2.4rhel10 6.3.2.4rhel8 6.3.2.4
NIST 800-53
AU-5
Live verification
rhel10:checkrhel8:checkrhel9:check
#audit#auditd#disk-space#security