The operating system must configure auditing to reduce the likelihood of storage capacity being exceeded.

An XCCDF Rule

Description

<VulnDiscussion>Overflowing the audit storage area can result in a denial of service or system outage.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

ID: SV-219968r854531_rule
Severity: High
References: CCI-001849
Updated: 9 months ago

The Audit Control profile is required.

This action applies to the global zone only. Determine the zone that you are currently securing.

# zonename
If the command output is "global", this action applies.

Set the size of a binary audit file to a specific size. The size is specified in megabytes.

# pfexec auditconfig -setplugin audit_binfile p_fsize=4M

Restart the audit system.

# pfexec audit -s

The operating system must configure auditing to reduce the likelihood of storage capacity being exceeded.

Description

Remediation - Manual Procedure