The Oracle Linux operating system must be configured so that the audit system takes appropriate action when the audit storage volume is full.
An XCCDF Rule
Description
Taking appropriate action in case of a filled audit storage volume will minimize the possibility of losing audit records. One method of off-loading audit logs in Oracle Linux is with the use of the audisp-remote dameon.
- ID
- SV-221772r958754_rule
- Version
- OL07-00-030320
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
Configure the action the operating system takes if the disk the audit records are written to becomes full.
Uncomment or edit the "disk_full_action" option in "/etc/audisp/audisp-remote.conf" and set it to "syslog", "single", or "halt", such as the following line:
disk_full_action = single