| Check "/etc/audit/auditd.conf" for the "space_left_action" with the following command: |
# cat /etc/audit/auditd.conf | grep space_left_action
If the "space_left_action" parameter is missing, set to "ignore", set to "suspend", set to "single", set to "halt", or is blank, this is a finding.
space_left_action = SYSLOG
If the "space_left_action" is set to "exec" the system executes a designated script. If this script informs the SA of the event, this is not a finding.
If the "space_left_action" is set to "email" and the "action_mail_acct" parameter is not set to the email address of the system administrator, this is a finding.
The "action_mail_acct parameter", if missing, defaults to "root". Note that if the email address of the system administrator is on a remote system "sendmail" must be available.