Details

Configure the maximum size of the audit log file. Once the log reaches the maximum size, it will be rotated and a new log file will be started.

Rationale:

It is important that an appropriate size is determined for log files so that they do not impact the system and audit data is not lost.

Solution

Set the max_log_file parameter in /etc/audit/auditd.conf

max_log_file =

Note: MB is the number of Megabytes the file can be.

Supportive Information

The following resource is also helpful.

• https://workbench.cisecurity.org/files/3096

This security hardening control applies to the following category of controls within NIST 800-53: Audit and Accountability.This control applies to the following type of system Unix.

References

• 800-53|AU-4
• CSCv6|6.3
• CSCv7|6.4

Source

• Tenable.com/audits