UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The remote audit system must take appropriate action when audit storage is full.


Overview

Finding ID Version Rule ID IA Controls Severity
V-215040 UBTU-16-020070 SV-215040r610931_rule Medium
Description
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity.
STIG Date
Canonical Ubuntu 16.04 LTS Security Technical Implementation Guide 2020-12-09

Details

Check Text ( C-16239r284988_chk )
Verify the action that the remote audit system takes when the storage volume becomes full.

Check the action that the remote audit system takes when the storage volume becomes full with the following command:

# sudo grep disk_full /etc/audisp/audisp-remote.conf

disk_full_action = single

If the value of the "disk_full_action" option is not "syslog", "single", or "halt", or the line is commented out, this is a finding.
Fix Text (F-16237r284989_fix)
Configure the remote audit system to take an appropriate action when the audit storage is full.

Add, edit or uncomment the "disk_full_action" option in "/etc/audisp/audisp-remote.conf". Set it to "syslog", "single" or "halt" like the below example:

disk_full_action = single