The operating system must provide an immediate warning to the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75% of repository maximum audit record storage capacity.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-58323	AOSX-09-000305	SV-72753r1_rule		Medium

Description
The audit service must be configured to require a minimum percentage of free disk space in order to run. This ensures that audit will notify the administrator that action is required to free up more disk space for audit logs. When minfree is set to 25%, security personnel are notified immediately when the storage volume is 75% full and are able to plan for audit record storage capacity expansion.

STIG	Date
Apple OS X 10.9 (Mavericks) Workstation Security Technical Implementation Guide	2017-01-05

Details

Check Text ( C-59149r1_chk )
The check displays the '% free' to leave available for the system. The audit system will not write logs if the volume has less than this percentage of free disk space. To view the current setting, run the following command: sudo grep ^minfree /etc/security/audit_control If this returns no results, or does not contain 25, this is a finding.

Fix Text (F-63639r1_fix)
Edit the /etc/security/audit_control file, and change the value for 'minfree' to 25. Use the following command to set the 'minfree' value to '25%': sudo sed -i.bak 's/.*minfree.*/minfree:25/' /etc/security/audit_control; sudo audit -s A text editor may also be used to implement the required update to the /etc/security/audit_control file.