The Oracle Linux operating system must use a separate file system for the system audit data path large enough to hold at least one week of audit data.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-221756 | OL07-00-021330 | SV-221756r958752_rule | Low |
| Description |
| The use of separate file systems for different paths can protect the system from failures resulting from a file system becoming full or failing. |
| STIG | Date |
| Oracle Linux 7 Security Technical Implementation Guide | 2024-08-26 |
Details
| Check Text (C-23471r419340_chk) |
| Determine if the operating system is configured to have the "/var/log/audit" path is on a separate file system. # grep /var/log/audit /etc/fstab If no result is returned, or the operating system is not configured to have "/var/log/audit" on a separate file system, this is a finding. Verify that "/var/log/audit" is mounted on a separate file system: # mount | grep "/var/log/audit" If no result is returned, or "/var/log/audit" is not on a separate file system, this is a finding. Verify the size of the audit file system: # df -h /var/log/audit If the size is insufficient for a week of audit data, this is a finding. |
| Fix Text (F-23460r419341_fix) |
| Migrate the system audit data path onto an appropriately sized separate file system to store at least one week of audit records. |