Details

The auditd daemon can be configured to halt the system when the audit logs are full. In high security contexts, the risk of detecting unauthorized access or nonrepudiation exceeds the benefit of the system’s availability.

Solution

Set the following parameters in /etc/audit/auditd.conf: space_left_action = emailaction_mail_acct = rootadmin_space_left_action = halt

Supportive Information

The following resource is also helpful.

• https://workbench.cisecurity.org/files/1864

This security hardening control applies to the following category of controls within NIST 800-53: Audit and Accountability.This control applies to the following type of system Unix.

References

• 800-53|AU-5
• CSCv6|6.3

Source

• Tenable.com/audits