The audit system must take appropriate action when there are disk errors on the audit storage volume.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-209059	OL6-00-000511	SV-209059r793780_rule		Medium

Description
Taking appropriate action in case of disk errors will minimize the possibility of losing audit records.

STIG	Date
Oracle Linux 6 Security Technical Implementation Guide	2021-12-03

Details

Check Text ( C-9312r357962_chk )
Inspect "/etc/audit/auditd.conf" and locate the following line to determine if the system is configured to take appropriate action when disk errors occur: # grep disk_error_action /etc/audit/auditd.conf disk_error_action = [ACTION] If the system is configured to "suspend" when disk errors occur or "ignore" them, this is a finding.

Fix Text (F-9312r357963_fix)
Edit the file "/etc/audit/auditd.conf". Modify the following line, substituting [ACTION] appropriately: disk_error_action = [ACTION] Possible values for [ACTION] are described in the "auditd.conf" man page. These include: "ignore" "syslog" "exec" "suspend" "single" "halt" Set this to "syslog", "exec", "single", or "halt".