The macOS system must configure audit capacity warning.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-259468	APPL-14-001030	SV-259468r958424_rule		Medium

Description

The audit service must be configured to notify the system administrator when the amount of free disk space remaining reaches an organization defined value. This rule ensures that the system administrator is notified in advance that action is required to free up more disk space for audit logs. Satisfies: SRG-OS-000046-GPOS-00022,SRG-OS-000343-GPOS-00134

STIG	Date
Apple macOS 14 (Sonoma) Security Technical Implementation Guide	2024-12-04

Details

Check Text (C-63207r941024_chk)

Verify the macOS system is configured to require a minimum of 25 percent free disk space for audit record storage with the following command:

/usr/bin/awk -F: '/^minfree/{print $2}' /etc/security/audit_control

If the result is not "25", this is a finding.

Fix Text (F-63115r941025_fix)

Configure the macOS system to require a minimum of 25 percent free disk space for audit record storage with the following command:

/usr/bin/sed -i.bak 's/.*minfree.*/minfree:25/' /etc/security/audit_control; /usr/sbin/audit -s