The macOS system must provide an immediate warning to the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) when allocated audit record storage volume reaches 75 percent of repository maximum audit record storage capacity.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-257180	APPL-13-001030	SV-257180r905173_rule		Low

Description
The audit service must be configured to require a minimum percentage of free disk space to run. This ensures that audit will notify the administrator that action is required to free up more disk space for audit logs. When "minfree" is set to 25 percent, security personnel are notified immediately when the storage volume is 75 percent full and are able to plan for audit record storage capacity expansion.

Description

The audit service must be configured to require a minimum percentage of free disk space to run. This ensures that audit will notify the administrator that action is required to free up more disk space for audit logs. When "minfree" is set to 25 percent, security personnel are notified immediately when the storage volume is 75 percent full and are able to plan for audit record storage capacity expansion.

STIG	Date
Apple macOS 13 (Ventura) Security Technical Implementation Guide	2024-02-06

Details

Check Text ( C-60865r905171_chk )
Verify the macOS system is configured to require a minimum of 25 percent free disk space for audit record storage with the following command: /usr/bin/sudo /usr/bin/grep ^minfree /etc/security/audit_control minfree:25 If "minfree" is not set to "25", this is a finding.

Fix Text (F-60806r905172_fix)
Configure the macOS system to require 25 percent free disk space for audit record storage with the following command: /usr/bin/sudo /usr/bin/sed -i.bak 's/.minfree./minfree:25/' /etc/security/audit_control; /usr/bin/sudo /usr/sbin/audit -s Alternatively, use a text editor to update the "/etc/security/audit_control" file.