The audit system must alert designated staff members when the audit storage volume approaches capacity.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-38470	RHEL-06-000005	SV-50270r2_rule		Medium

Description
Notifying administrators of an impending disk space problem may allow them to take corrective action prior to any disruption.

STIG	Date
Red Hat Enterprise Linux 6 Security Technical Implementation Guide	2017-04-28

Details

Check Text ( None )
None

Fix Text (F-43415r2_fix)
The "auditd" service can be configured to take an action when disk space starts to run low. Edit the file "/etc/audit/auditd.conf". Modify the following line, substituting [ACTION] appropriately: space_left_action = [ACTION] Possible values for [ACTION] are described in the "auditd.conf" man page. These include: "ignore" "syslog" "email" "exec" "suspend" "single" "halt" Set this to "email" (instead of the default, which is "suspend") as it is more likely to get prompt attention. The "syslog" option is acceptable, provided the local log management infrastructure notifies an appropriate administrator in a timely manner. RHEL-06-000521 ensures that the email generated through the operation "space_left_action" will be sent to an administrator.

Fix Text (F-43415r2_fix)

The "auditd" service can be configured to take an action when disk space starts to run low. Edit the file "/etc/audit/auditd.conf". Modify the following line, substituting [ACTION] appropriately:

space_left_action = [ACTION]

Possible values for [ACTION] are described in the "auditd.conf" man page. These include:

"ignore"
"syslog"
"email"
"exec"
"suspend"
"single"
"halt"

Set this to "email" (instead of the default, which is "suspend") as it is more likely to get prompt attention. The "syslog" option is acceptable, provided the local log management infrastructure notifies an appropriate administrator in a timely manner.

RHEL-06-000521 ensures that the email generated through the operation "space_left_action" will be sent to an administrator.