SQL Server must have allocated audit record storage capacity to meet the organization-defined requirements for saving audit record information.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-41026	SQL2-00-010600	SV-53401r2_rule		Medium

Description
SQL Server does not have the ability to be cognizant of potential audit log storage capacity issues. During the installation and/or configuration process, SQL Server should detect and determine if adequate storage capacity has been allocated for audit logs. During the installation process, a notification may be provided to the installer indicating, based on the auditing configuration chosen and the amount of storage space allocated for audit logs, the amount of storage capacity available is not sufficient to meet storage requirements. SQL Server is not able to send out notice based on adequate storage capacity allocated for the audit logs.

Description

SQL Server does not have the ability to be cognizant of potential audit log storage capacity issues. During the installation and/or configuration process, SQL Server should detect and determine if adequate storage capacity has been allocated for audit logs. During the installation process, a notification may be provided to the installer indicating, based on the auditing configuration chosen and the amount of storage space allocated for audit logs, the amount of storage capacity available is not sufficient to meet storage requirements. SQL Server is not able to send out notice based on adequate storage capacity allocated for the audit logs.

STIG	Date
Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide	2015-06-23

Details

Check Text ( C-47643r2_chk )
From a Command Prompt, open fsrm.msc. If fsrm.msc is not installed, the File Server Resource Manager is not installed; File and Folder Quota Management is not enabled. If File Server Resource Manager or a third-party tool capable of sending alert notifications based on audit log store requirements is not installed, this is a finding. If fsrm.msc is installed, expand File Server Resource Manager in the left pane. Expand Quota Management. Expand Quotas. If Quotas have not been created for defined Audit Log storage locations, this is a finding.

Check Text ( C-47643r2_chk )

From a Command Prompt, open fsrm.msc.
If fsrm.msc is not installed, the File Server Resource Manager is not installed; File and Folder Quota Management is not enabled. If File Server Resource Manager or a third-party tool capable of sending alert notifications based on audit log store requirements is not installed, this is a finding.

If fsrm.msc is installed, expand File Server Resource Manager in the left pane.
Expand Quota Management.
Expand Quotas.
If Quotas have not been created for defined Audit Log storage locations, this is a finding.

Fix Text (F-46325r1_fix)
Use File Server Resource Manager (FSRM.msc) to enable File and Folder Quota Management and create quotas for identified Audit storage locations.