Details

In high security contexts, the risk of detecting unauthorized access or nonrepudiation exceeds the benefit of the system’s availability.

Solution

Set the following parameters in /etc/audit/auditd.conf-space_left_action = email
action_mail_acct = root
admin_space_left_action = halt

Supportive Information

The following resource is also helpful.

• https://workbench.cisecurity.org/files/1863

This security hardening control applies to the following category of controls within NIST 800-53: Audit and Accountability.This control applies to the following type of system Unix.

References

• 800-53|AU-5
• CSCv6|6.3

Source

• Tenable.com/audits