The macOS system must configure audit capacity warning.
An XCCDF Rule
Description
The audit service must be configured to notify the system administrator when the amount of free disk space remaining reaches an organization-defined value. This rule ensures that the system administrator is notified in advance that action is required to free up more disk space for audit logs. Satisfies: SRG-OS-000046-GPOS-00022, SRG-OS-000343-GPOS-00134
- ID
- SV-268468r1034344_rule
- Version
- APPL-15-001030
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
Configure the macOS system to require a minimum of 25 percent free disk space for audit record storage with the following command:
/usr/bin/sed -i.bak 's/.*minfree.*/minfree:25/' /etc/security/audit_control; /usr/sbin/audit -s