1. Home
  2. Security Hardening
  3. DISA STIG Apple Mac OSX 10 15 V1R7
  4. AOSX-15-001030 – The macOS system must provide an immediate warning to the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) when allocated audit record storage volume reaches 75 percent of repository maximum audit record storage capacity.
Searching...

AOSX-15-001030 – The macOS system must provide an immediate warning to the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) when allocated audit record storage volume reaches 75 percent of repository maximum audit record storage capacity.

Details

The audit service must be configured to require a minimum percentage of free disk space in order to run. This ensures that audit will notify the administrator that action is required to free up more disk space for audit logs.

When ‘minfree’ is set to 25 percent, security personnel are notified immediately when the storage volume is 75 percent full and are able to plan for audit record storage capacity expansion.

Solution

Edit the ‘/etc/security/audit_control’ file and change the value for ‘minfree’ to ’25’ using the following command:

/usr/bin/sudo /usr/bin/sed -i.bak ‘s/.*minfree.*/minfree:25/’ /etc/security/audit_control; /usr/bin/sudo /usr/sbin/audit -s

A text editor may also be used to implement the required updates to the ‘/etc/security/audit_control file’.

Supportive Information

The following resource is also helpful.

This security hardening control applies to the following category of controls within NIST 800-53: Audit and Accountability.This control applies to the following type of system Unix.

References

Source

Updated on July 16, 2022
Was this article helpful?
Yes No

Related Articles