UCF STIG Viewer Logo

The Photon operating system must configure auditd to keep five rotated log files.


Finding ID Version Rule ID IA Controls Severity
V-239129 PHTN-67-000058 SV-239129r675195_rule Medium
Audit logs are most useful when accessible by date, rather than size. This can be accomplished through a combination of an audit log rotation cron job, setting a reasonable number of logs to keep and configuring auditd to not rotate the logs on its own. This ensures that audit logs are accessible to the ISSO in the event of a central log processing failure.
VMware vSphere 6.7 Photon OS Security Technical Implementation Guide 2022-06-17


Check Text ( C-42340r675193_chk )
At the command line, execute the following command:

# grep "^max_log_file_action" /etc/audit/auditd.conf

Expected result:

max_log_file_action = IGNORE

If the output of the command does not match the expected result, this is a finding.
Fix Text (F-42299r675194_fix)
Open /etc/audit/auditd.conf with a text editor.

Add or change the "max_log_file_action" line as follows:

max_log_file_action = IGNORE

At the command line, execute the following command:

# service auditd reload