mediumfilesystemverified ✓

Ensure /var/log/audit is on a separate filesystem

mount-var-log-audit-separate-fs · RHEL ≥ 8 · 1 impl

Description

The /var/log/audit directory must be on a separate filesystem or logical volume. A dedicated partition for audit data prevents audit log growth from consuming other filesystem space.

Rationale

Without a separate /var/log/audit filesystem, audit log accumulation could fill the /var/log or /var filesystem, disabling the audit subsystem. A separate audit partition ensures audit data is preserved independently of other system activity.

Check → Remediate

Checkcommand

findmnt /var/log/audit 2>/dev/null | grep -v '^TARGET' | awk '{print $1}' | grep -q '/var/log/audit$'

expected_exit:: 0

Remediatemanual

note:: Create a separate partition or logical volume for /var/log/audit and add it to /etc/fstab. Migrate existing audit data to the new partition.

Framework references

CIS

rhel9 1.1.2.7.1rhel10 1.1.2.7.1rhel8 1.1.2.7.1

STIG

V-280936 / RHEL-10-000520V-257847 / RHEL-09-231030V-230294

NIST 800-53

AU-4CM-6

Live verification

rhel10:checkrhel8:checkrhel9:check

#mount#audit#filesystem#hardening